CVE-2026-111668: AIHelms through 0.1.25 Missing Authorization in Efficiency Analytics API
AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes like /cost/detail, /top-users and /budget to read organization-wide AI spend, and can modify suggestion statuses or generate reports.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated AIHelms user with low privileges can exploit it. The attacker does not need the efficiency:read or efficiency:write permissions that should protect the affected analytics functions.
What information and actions are exposed?
An attacker can read organization-wide AI spending data through routes including /cost/detail, /top-users, and /budget. They can also modify suggestion statuses and generate reports.
Are unauthenticated users affected?
The available information describes exploitation by authenticated users. It does not indicate that unauthenticated access is possible.
Which versions are affected?
AIHelms through version 0.1.25 is affected. No fixed version is provided in the available information.