CVE-2026-111681

EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters.

A low-privilege user can escalate to administrator and take control of Kafka clusters. This leads to full system compromise and potential further attacks.

Upgrade EFAK to a patched version or add administrator role checks to the /api/users endpoints. Check for unauthorized creation of administrator accounts.