EFAK CVE-2026-111682

Exploitation requires (1) a valid authenticated account on the EFAK web application at the lowest privilege tier (ROLE_USER) - the vulnerable /api/model-config endpoints lack the admin authorization gate present in WebSecurityConfig - and (2) that the deployment actually uses the LLM model-config feature with provider API keys stored, since there are no secrets to disclose otherwise. Limiting factors: no anonymous/unauthenticated access is possible (PR:L), and risk is concentrated in multi-user or multi-tenant installations where untrusted parties can obtain ROLE_USER accounts; a single-administrator deployment with no configured LLM keys is effectively not exposed.

This is a moderate, credential-exposure issue rather than a critical system-compromise flaw, and the signals are internally consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack but one that REQUIRES an existing authenticated low-privilege account (PR:L) - so it is not remote-unauthenticated despite the network vector. Impact is confidentiality-only (VC:H, with VI/VA:N and no scope change), reflecting disclosure of secrets rather than code execution or data tampering. No EPSS score was provided, so exploitation probability cannot be quantified. KEV status is not indicated, so there is no evidence of active exploitation; per available data this is 'no public exploit identified at time of analysis,' although the referenced HackMD writeup and VulnCheck advisory pinpoint the exact vulnerable controller and security-config lines, meaning the technical path is fully documented and trivially reproducible for anyone with a user account. Net: a real but bounded priority - most dangerous for multi-tenant/shared EFAK deployments where untrusted users hold ROLE_USER accounts and LLM provider keys are configured; lower priority where EFAK is single-admin or the LLM integration is unused. No SSVC decision data was supplied.

A user with any low-privilege ROLE_USER account in a shared EFAK deployment calls the /api/model-config/page or /api/model-config/{id} REST endpoint, which omits the admin authorization check, and receives LLM provider API keys in unmasked form. The attacker then uses those keys to access the organization's LLM provider account, running up usage costs or pivoting to data held in that provider. No public exploit tool is identified, but the low attack complexity and published technical analysis make exploitation straightforward for any authenticated user.