CVE-2026-125750

EUVD-2026-121232
Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin API base guard permits all GET actions. Editors can query options.js for TOTP secrets, push credentials, and cloud storage keys, or user.js for other users' app_key/app_secret to publish posts as administrators via admin/post_push.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/firekylin/firekylin/blob/2.18.1/src/controller/admin/api/base.js#L69-L77
https://github.com/firekylin/firekylin/blob/2.18.1/src/controller/admin/api/options.js#L12-L41
https://github.com/firekylin/firekylin/issues/975
https://github.com/firekylin/firekylin/pull/976
https://hackmd.io/@hieund/firekylin-admin-api-editor-missing-authz-secret-disclosure
https://www.vulncheck.com/advisories/firekylin-through-2.18.1-improper-authorization-via-admin-rest-api-get-actions