https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-19T14:43:02.290047+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-111682 fkie_cve-2026-111682 2026-10-19T14:43:02.311406+00:00

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling provider account access and incurred costs.

 https://db.gcve.eu/vuln/ghsa-jqpg-p8wq-hcmv GHSA-jqpg-p8wq-hcmv 2026-10-19T14:43:02.311466+00:00

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling provider account access and incurred costs.