AIHelms through 0.1.25 contains a missing authorization flaw in its Efficiency Analytics API. This flaw allows any authenticated user with low-privileged status to bypass the expected efficiency:read and efficiency:write permission checks, enabling attackers to query routes such as /cost/detail, /top-users, and /budget to obtain organization-wide AI expenditure information, and to modify suggestion statuses or generate reports that were intended to be protected.

The defect exists in the AIHelms 0.1.25 release from vendor beizhu-1209, specifically in the apps/api/v1/efficiency.py module. No other versions or vendors are mentioned in the CVE data, so only AIHelms 0.1.25 is impacted.

The CVSS score of 5.3 indicates a moderate risk. No EPSS value is available, so the exploitation likelihood is currently unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to authenticate with an account that has low privileges; from there, they can exploit the missing authorization to read or modify data through the public API, without requiring privileged network access.