CVE-2026-111681

EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters.