EFAK CVE-2026-111681

Requires a valid authenticated low-privilege EFAK account (PR:L); exploitation is not pre-authentication. The flaw lies in the /api/users endpoints handled by UserController (POST/PUT/DELETE), which WebSecurityConfig fails to restrict to administrators, so no special non-default feature toggle is needed - it affects standard configurations of EFAK through 5.1.0. The only real limiting factor is obtaining low-privilege credentials; there is no user interaction requirement and no platform-specific constraint. Risk rises sharply in deployments that allow user self-registration or distribute shared low-privilege logins.

This is a genuine, actionable privilege-escalation issue rather than an inflated high-CVSS score, but its real-world urgency is tempered by the prerequisite of an existing low-privilege account. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and score of 8.7 (High) are internally consistent with the description: a network-reachable REST API (UserController /api/users) that performs no administrator role check, exploitable with low complexity by any authenticated user, yielding full confidentiality, integrity and availability impact (VC:H/VI:H/VA:H) by letting the attacker self-promote to ROLE_ADMIN. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no exploit-code flag was provided, so there is no public exploit identified at time of analysis - though a detailed third-party technical write-up (hackmd) and a VulnCheck advisory describe the flaw precisely enough to make weaponization trivial. No SSVC decision data was provided. The one clear limiting factor is PR:L: exploitation is not pre-authentication, so blast radius depends on how freely low-privilege EFAK accounts are provisioned; in multi-tenant or self-registration deployments the barrier is effectively negligible, while in tightly controlled single-operator installs it is higher. Note the input Tag 'Authentication Bypass' is a mischaracterization - CWE-862 (Missing Authorization) and the description both describe authorization failure for an already-authenticated user, not authentication bypass.

An attacker who holds any ordinary low-privilege EFAK account (or obtains one via self-registration/shared credentials) sends a crafted POST or PUT request to the /api/users endpoint, which lacks an administrator role gate, and assigns their own account ROLE_ADMIN. With administrator rights they then create further admin accounts, delete legitimate users, and assume full control over all Kafka clusters managed through EFAK. No public exploit is identified at time of analysis, but a detailed technical write-up documenting the exact endpoints and code locations is publicly available.