CVE-2026-111681
CVE-2026-111681
EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Weakness classification (CWE)
References
- hackmd.io/@hieuPenguinnn/efak-missing-admin-gate-user-management-api (third-party-advisory)
- github.com/smartloli/EFAK/blob/v5.1.0/efak-web/src/main/java/org/kafka/eagle/we… (technical-description)
- github.com/smartloli/EFAK/blob/v5.1.0/efak-web/src/main/java/org/kafka/eagle/we… (technical-description)
- github.com/smartloli/EFAK (product)
- VulnCheck Advisory: EFAK through 5.1.0 Privilege Escalation via /api/users REST API (third-party-advisory)
Frequently asked questions
- What is CVE-2026-111681?
- CVE-2026-111681 is a high-severity vulnerability, classified under Missing Authorization. CVSS score: 8.8/10. Published 2026-10-16.
- How severe is CVE-2026-111681?
- High severity. CVSS v3 base score is 8.8 out of 10.