CVE-2026-111681: Missing Authorization in smartloli EFAK

CVE-2026-111681 is a missing authorization vulnerability in smartloli EFAK up to version 5.1.0. The /api/users endpoints do not enforce administrator role checks, enabling authenticated low-privilege users to send POST, PUT, or DELETE requests to the UserController. This allows attackers to escalate privileges by assigning themselves the ROLE_ADMIN, create new administrator accounts, or delete existing users, resulting in potential takeover of managed Kafka clusters.

Successful exploitation grants attackers administrative privileges within the EFAK system, allowing them to control user accounts and potentially the entire managed Kafka clusters. This can lead to unauthorized access, data manipulation, and disruption of Kafka services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /api/users endpoints to trusted administrators only and monitor for suspicious activity involving user management APIs.