Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: smartloli Clear all filters
TI-2026-75468 CVE-2026-111682 · GHSA-jqpg-p8wq-hcmv

EFAK Missing Authorization in /api/model-config Exposes LLM API Keys

Priority MEDIUM 64

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00386 Published 2026-10-16 No fix listed CWE-862
TI-2026-75467 CVE-2026-111681 · GHSA-64mr-r26w-689m

Missing authorization in EFAK lets users gain administrator rights

Priority LOW 39

EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00283 Published 2026-10-16 No fix listed CWE-862