CVE-2026-111681 Details

A missing authorization vulnerability has been identified in EFAK (Eagle For Apache Kafka) versions through 5.1.0. This vulnerability allows authenticated low-privilege users to manage accounts via the /api/users endpoints, which lack proper administrator role checks. As a result, attackers can send POST, PUT, or DELETE requests to the UserController to grant themselves ROLE_ADMIN, create new administrators, or delete users. This exploitation could lead to unauthorized control over managed Kafka clusters.

To address this vulnerability, update the WebSecurityConfig to include proper role checks for the /api/users and /api/model-config endpoints. Additionally, implement validation to ensure that role assignments in user management requests are authorized. For a defense-in-depth approach, re-enable CSRF protection for state-changing operations.