Is CVE-2026-111682 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111682?

CVE-2026-111682 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-111682

Description

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling provider account access and incurred costs.