EFAK through 5.1.0 suffers a missing authorization flaw in its /api/users endpoints. Low‑privilege users can craft POST, PUT, or DELETE requests to UserController, granting themselves administrator privileges, creating new administrator accounts or deleting existing users. This allows an attacker to gain full control over the management layer that orchestrates Kafka clusters, potentially compromising data confidentiality, integrity, and availability. The weakness corresponds to CWE-862, an authorization failure.

The vulnerability affects the smartloli EFAK platform, specifically versions up to and including 5.1.0. Any instance of this software that implements the exposed /api/users endpoints without restricted administrator checks is susceptible.

With a CVSS score of 8.7, this issue is considered high severity. While EPSS is not available and the vulnerability is not flagged in the CISA KEV catalog, the attack vector requires authenticated access to EFAK and the ability to send HTTP requests to the API. An attacker possessing low‑privilege credentials can elevate privileges and potentially control the underlying Kafka clusters. The lack of a user‑level guard makes exploitation straightforward for anyone who can reach the API.