Smartloli vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Smartloli products: 2 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2026-111682 Medium · 6.5 CWE-862 Oct 16, 2026

EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling provider account access and incurred costs.

CVE-2026-111681 High · 8.8 CWE-862 Oct 16, 2026

EFAK through 5.1.0 Privilege Escalation via /api/users REST API

EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters.