AIHelms CVE-2026-111668

Exploitation requires an authenticated AIHelms account at or below version 0.1.25 - specifically a low-privileged user who does NOT hold the efficiency:read or efficiency:write permissions. The flaw is in the efficiency analytics API (apps/api/v1/efficiency.py), so the AIHelms API must be deployed and reachable, and the attacker must be able to reach routes including /cost/detail, /top-users, and /budget. The key limiting factor is the authentication requirement (PR:L): this is not exploitable by anonymous/unauthenticated attackers, so risk is confined to existing organization members or anyone able to obtain a low-privilege credential. No special non-default configuration or user interaction is needed beyond holding a valid low-privilege session.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 4.0 base score of 5.3 (MEDIUM) is consistent with the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N: network-reachable and low-complexity, but it requires an already-authenticated low-privileged account (PR:L), which meaningfully constrains the attacker population to existing tenant/org users rather than anonymous internet attackers. Impact is limited to LOW confidentiality (reading organization-wide AI spend) and LOW integrity (modifying suggestion statuses, generating reports) with no availability impact, so there is no code execution or full data compromise. No EPSS score was provided in the input, and the CVE is NOT listed in CISA KEV, so there is no evidence of active exploitation - exploitation status is 'no public exploit identified at time of analysis.' A public HackMD technical write-up and a VulnCheck advisory exist and point directly at the vulnerable source lines, which lowers the research barrier, but these are analysis/disclosure artifacts rather than confirmed weaponized exploit code. No SSVC decision data was supplied. The signals are internally consistent (authenticated, network, medium severity, no exploitation evidence), so this is best treated as a routine patch-prioritization item for AIHelms operators - notable because broken object/function-level authorization is trivially automatable once an account exists, but bounded by its niche footprint and low technical impact.

A low-privileged but authenticated user of an AIHelms deployment (e.g., an ordinary org member without the efficiency:read/efficiency:write roles) directly calls the efficiency analytics endpoints such as /cost/detail, /top-users and /budget. Because apps/api/v1/efficiency.py omits the permission checks, the server returns organization-wide AI spend data and also accepts requests to modify suggestion statuses or generate reports. No public exploit code is identified, but a HackMD write-up documents the exact vulnerable routes and lines, making reproduction straightforward for anyone with a valid account.