Firekylin: Improper authorization vulnerability (CVE-2026-125750)

Firekylin versions 2.18.1 and earlier contain an improper authorization vulnerability in the admin API base guard. The vulnerability exists because the guard mechanism fails to restrict GET requests for administrative endpoints. An attacker authenticated with 'editor' privileges can perform unauthorized queries against the 'options.js' and 'user.js' endpoints to retrieve sensitive data, including TOTP secrets, push credentials, and cloud storage keys. Furthermore, attackers can exploit this access to retrieve user API keys ('app_key'/'app_secret'), enabling them to publish content as administrators via the 'admin/post_push' endpoint.

Impact

The impact of this vulnerability includes the unauthorized disclosure of sensitive system configuration and administrative credentials, and the potential for account takeover or unauthorized content publication.

Recommendation

• Identify all instances of Firekylin in the environment.
• Review access logs for 'editor'-role users accessing 'options.js', 'user.js', or 'admin/post_push' endpoints.
• Upgrade Firekylin to a version beyond 2.18.1 immediately upon vendor patch release.