EFAK: Missing authorization in /api/users user management API
Summary
EFAK (Eagle For Apache Kafka) through 5.1.0 does not check for the administrator role on its /api/users endpoints. An authenticated user with low privileges can send POST, PUT or DELETE requests to grant themselves ROLE_ADMIN, create administrators or delete users. This gives the attacker control over the Kafka clusters managed by EFAK; no fixed version is known yet.
Affected
- EFAK 5.0.0 to 5.1.0 according to the CVE record (CNA: VulnCheck)
- The CVE description says "through 5.1.0"; whether versions before 5.0.0 are affected is unknown.
Fixed in
Unknown.
Workaround
No vendor workaround found.
- Restrict access to /api/users at a reverse proxy or limit it to administrator networks.
- Keep EFAK off the public internet and reach it only through VPN or an internal network.
- Remove unused accounts and rotate credentials for shared logins.
Exploitation
- CISA SSVC: exploitation none, not automatable, total technical impact.
- Not listed as known exploited (KEV); no exploitation in the wild found.
- A third-party write-up and a VulnCheck advisory are referenced; whether they contain a working proof of concept is unverified.
Our recommendation
- Check whether EFAK is running in your environment and which versions are deployed.
- Review all accounts now for unexpected administrator roles or unknown users.
- Restrict network access to EFAK and to /api/users.
- Log and alert on user management API calls.
- Limit the Kafka credentials stored in EFAK to what monitoring requires.
- Install a fixed version as soon as the vendor publishes one.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- EFAK GitHub repository github.com
- UserController.java at v5.1.0 github.com
- WebSecurityConfig.java at v5.1.0 github.com
- VulnCheck advisory www.vulncheck.com
- HackMD write-up hackmd.io
- VulDB entry vuldb.com
- EFAK security page github.com
- CVE record mirror (threatint) cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:13.
Original description (NVD)
EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters.
NVD references (5)
- https://github.com/smartloli/EFAK
- https://github.com/smartloli/EFAK/blob/v5.1.0/efak-web/src/main/java/org/kafka/eagle/web/controller/UserContr…
- https://github.com/smartloli/EFAK/blob/v5.1.0/efak-web/src/main/java/org/kafka/eagle/web/security/config/WebS…
- https://hackmd.io/@hieuPenguinnn/efak-missing-admin-gate-user-management-api
- https://www.vulncheck.com/advisories/efak-through-5.1.0-privilege-escalation-via-api-users-rest-api
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.