{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aefakefak/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:efak:efak:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-111681"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["EFAK (\u003c= 5.1.0)"],"_cs_severities":["high"],"_cs_tags":["web-application","privilege-escalation","kafka"],"_cs_type":"threat","_cs_vendors":["EFAK"],"content_html":"\u003cp\u003eEFAK (formerly Kafka Eagle) versions up to 5.1.0 contain a critical missing authorization vulnerability (CVE-2026-111681). The flaw exists within the /api/users endpoints, which fail to verify if the requesting user possesses administrative privileges before processing account management requests. An authenticated, low-privilege attacker can exploit this by submitting crafted POST, PUT, or DELETE requests to the UserController. This allows the attacker to escalate their own account to ROLE_ADMIN, create new administrative accounts, or delete existing users. Successful exploitation results in the attacker gaining full administrative control over the EFAK instance, which enables further unauthorized management and monitoring of the integrated Kafka clusters. Defenders should ensure EFAK is updated to a patched version once available.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows low-privileged users to achieve full administrative control over the EFAK platform. This compromise extends to the managed Kafka clusters, where the attacker can disrupt message flows, access sensitive cluster configuration data, or delete existing legitimate administrator accounts to maintain persistent, unauthorized access. There is currently no data on the number of victims or active exploitation in the wild.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor web application logs for POST, PUT, or DELETE requests to /api/users coming from non-administrative user accounts.\u003c/li\u003e\n\u003cli\u003ePatch or upgrade EFAK to the version addressing CVE-2026-111681 as soon as it is released by the vendor.\u003c/li\u003e\n\u003cli\u003eImplement restrictive access controls on the network to limit access to the EFAK management interface to authorized personnel only.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:50:04Z","date_published":"2026-10-16T18:50:04Z","id":"https://feed.craftedsignal.io/briefs/2026-10-efak-missing-auth/","summary":"Authenticated low-privileged users can exploit missing authorization checks in EFAK 5.1.0 and earlier to escalate privileges and perform administrative actions on managed Kafka clusters.","title":"Missing Authorization Vulnerability in EFAK","url":"https://feed.craftedsignal.io/briefs/2026-10-efak-missing-auth/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:efak:efak:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}