Authenticated users with any ROLE_USER account can query the /api/model-config/page or /api/model-config/{id} endpoints to retrieve unmasked LLM provider API keys. The missing authorization check allows low‑privilege users to expose credentials that grant external account access, potentially leading to unauthorized usage, elevated costs, and data access beyond intended scope. This flaw represents a disclosure of sensitive tokens rather than code execution.

smartloli EFAK 5.0.0 through 5.1.0 are affected. Any deployment of these versions running the efak-web component with the default security configuration is vulnerable. The vulnerability originates in the ModelConfigController and the WebSecurityConfig classes.

The CVSS score of 7.1 indicates a high impact for confidentiality, while the EPSS score is not available. The flaw can be exploited by any authenticated user with a standard role without elevated privileges. Because the disclosure involves sensitive API keys, the risk includes unexpected charges and potential data extraction from third‑party LLM services. The vulnerability is not listed in CISA KEV, and there is no publicly disclosed exploit yet, but the lack of authorization control makes it a critical asset‑access issue.