CVE-2026-111682: Missing Authorization in smartloli EFAK

CVE-2026-111682 describes a missing authorization vulnerability in smartloli EFAK versions 5.0.0 through 5.1.0. Authenticated users with any ROLE_USER privilege can query the /api/model-config/page or /api/model-config/{id} endpoints to retrieve unmasked LLM provider API keys. These keys enable access to the provider accounts, potentially allowing attackers to misuse the service and incur costs. The vulnerability has a CVSS 4.0 base score of 7.1, indicating high severity. No known exploits in the wild or vendor patches are currently documented.

The vulnerability allows low-privilege authenticated users to obtain sensitive API keys without proper authorization. This can lead to unauthorized access to LLM provider accounts, resulting in potential misuse of services and financial costs. The exposure of unmasked keys represents a significant confidentiality breach.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to ROLE_USER accounts and monitor API usage closely. Avoid sharing API keys in accessible endpoints and consider rotating keys if compromise is suspected.