{"metadata": {"vulnerability": "CVE-2026-111681", "count": 16, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-10-15T00:00:00Z", "date_only": false, "value": "2026-10-15T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111681", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-16T14:31:19.095Z", "date_only": false, "value": "2026-10-16T14:31:19.095Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-111681", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-16T17:39:39.410Z", "date_only": false, "value": "2026-10-16T17:39:39.410Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-111681", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T17:39:39.410Z", "date_only": false, "value": "2026-10-16T17:39:39.410Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-111681", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T18:17:51Z", "date_only": false, "value": "2026-10-16T18:17:51Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-64MR-R26W-689M", "record": "GHSA-64MR-R26W-689M", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T18:17:51.063Z", "date_only": false, "value": "2026-10-16T18:17:51.063", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111681", "record": "FKIE_CVE-2026-111681", "field": "published"}, {"timestamp": "2026-10-16T18:34:50Z", "date_only": false, "value": "2026-10-16T18:34:50Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-64MR-R26W-689M", "record": "GHSA-64MR-R26W-689M", "field": "published"}, {"timestamp": "2026-10-16T18:34:50Z", "date_only": false, "value": "2026-10-16T18:34:50Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-64MR-R26W-689M", "record": "GHSA-64MR-R26W-689M", "field": "modified"}, {"timestamp": "2026-10-16T18:40:55.864Z", "date_only": false, "value": "2026-10-16T18:40:55.864040Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117452049955105187", "record": "CVE-2026-111681", "field": "creation_timestamp", "uuid": "9660af28-839d-4611-b22d-b5343f90f764", "content": "CVE-2026-111681 EFAK through 5.1.0 Privilege Escalation via /api/users REST API EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters.\nhttps://www.cve.org/CVERecord?id=CVE-2026-111681https://hackmd.io/@hieuPenguinnn/efak-missing-admin-gate-user-management-apihttps://github.com/smartloli/EFAK/blob/v5.1.0/efak-web/src/main/java/org/kafka/eagle/web/security/config/WebSecurityConfig.java#L89-L93https://github.com/smartloli/EFAK/blob/v5.1.0/efak-web/src/main/java/org/kafka/eagle/web/controller/UserController.java#L218-L302https://github.com/smartloli/EFAKhttps://www.vulncheck.com/advisories/efak-through-5.1.0-privilege-escalation-via-api-users-rest-api#smartloli #EFAK#CVE_2026_111681#bot", "url": "https://infosec.exchange/users/cve/statuses/117452049955105187"}, {"timestamp": "2026-10-16T20:51:54.682Z", "date_only": false, "value": "2026-10-16T20:51:54.682916Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-111681", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T20:51:54.682Z", "date_only": false, "value": "2026-10-16T20:51:54.682916Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111681", "record": "FKIE_CVE-2026-111681", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T21:17:35.235Z", "date_only": false, "value": "2026-10-16T21:17:35.235Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-111681", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T21:17:35.235Z", "date_only": false, "value": "2026-10-16T21:17:35.235Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-111681", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T22:17:22.387Z", "date_only": false, "value": "2026-10-16T22:17:22.387", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111681", "record": "FKIE_CVE-2026-111681", "field": "lastModified"}, {"timestamp": "2026-10-17T03:50:06.488Z", "date_only": false, "value": "2026-10-17T03:50:06.488368Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3my26qmal5d2z", "record": "CVE-2026-111681", "field": "creation_timestamp", "uuid": "7bc5479c-a3af-4410-9792-4a5a3d5c15c9", "content": "CVE-2026-111681 - efak\nIn versions up to 5.1.0, the EFAK web interface does not check that a user is an administrator before allowing changes to accounts via its /api/users endpoints. A user with a normal\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#efak #smartloli #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3my26qmal5d2z"}, {"timestamp": "2026-10-18T03:17:16.968Z", "date_only": false, "value": "2026-10-18T03:17:16.968533Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3my4netcv5c2e", "record": "CVE-2026-111681", "field": "creation_timestamp", "uuid": "f21beabc-c655-49a5-8ff1-801ef402f6a6", "content": "\ud83d\udfe0 CVE-2026-111681 - High (8.8)\n\nEFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-p...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-111681/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3my4netcv5c2e"}]}