CVE-2026-111682

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling provider account access and incurred costs.

The vulnerability allows unauthorized access to LLM provider API keys, potentially leading to uncontrolled costs and abuse. The organization may suffer financial losses and breach contracts with providers.

Update EFAK to a version later than 5.1.0 or apply the vendor patch. It is also recommended to rotate all LLM provider API keys that may have been exposed.