Is CVE-2026-111668 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111668?

CVE-2026-111668 has a CVSS v3 severity of MEDIUM (5.4).

Back

CVE-2026-111668

Description

AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes like /cost/detail, /top-users and /budget to read organization-wide AI spend, and can modify suggestion statuses or generate reports.