Skip to content
OpenAdvisories

Vendor

smartloli

2 known vulnerabilities.

Products

EFAK 2
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.5
    CVE-2026-111682

    EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys

    EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page o…

    smartloli EFAK