EFAK (<= 5.1.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/efak--5.1.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 16 Oct 2026 18:50:04 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMissing Authorization Vulnerability in EFAKhttps://feed.craftedsignal.io/briefs/2026-10-efak-missing-auth/Fri, 16 Oct 2026 18:50:04 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-efak-missing-auth/Authenticated low-privileged users can exploit missing authorization checks in EFAK 5.1.0 and earlier to escalate privileges and perform administrative actions on managed Kafka clusters.EFAK (formerly Kafka Eagle) versions up to 5.1.0 contain a critical missing authorization vulnerability (CVE-2026-111681). The flaw exists within the /api/users endpoints, which fail to verify if the requesting user possesses administrative privileges before processing account management requests. An authenticated, low-privilege attacker can exploit this by submitting crafted POST, PUT, or DELETE requests to the UserController. This allows the attacker to escalate their own account to ROLE_ADMIN, create new administrative accounts, or delete existing users. Successful exploitation results in the attacker gaining full administrative control over the EFAK instance, which enables further unauthorized management and monitoring of the integrated Kafka clusters. Defenders should ensure EFAK is updated to a patched version once available.

Impact

Successful exploitation of this vulnerability allows low-privileged users to achieve full administrative control over the EFAK platform. This compromise extends to the managed Kafka clusters, where the attacker can disrupt message flows, access sensitive cluster configuration data, or delete existing legitimate administrator accounts to maintain persistent, unauthorized access. There is currently no data on the number of victims or active exploitation in the wild.

Recommendation

  • Monitor web application logs for POST, PUT, or DELETE requests to /api/users coming from non-administrative user accounts.
  • Patch or upgrade EFAK to the version addressing CVE-2026-111681 as soon as it is released by the vendor.
  • Implement restrictive access controls on the network to limit access to the EFAK management interface to authorized personnel only.
]]>highthreatweb-applicationprivilege-escalationkafka