Login Request a demo
Medium severity · published Oct 16, 2026
CVE-2026-111679
Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll(), disabling the login rate limiter during password guessing against super_admin accounts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EK
ekko-studio · EKKOLearnAI
through 0.7.36 · source: vendor
Affected product
EK
ekko-studio
EKKOLearnAI
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111679
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111679
github.com
https://github.com/EKKOLearnAI/ekko-studio/blob/v0.7.36/packages/server/src/modules/studio/controllers/auth.ts#L807-L822
github.com
https://github.com/EKKOLearnAI/ekko-studio/blob/v0.7.36/packages/server/src/modules/studio/routes/auth.ts#L26-L27
github.com
https://github.com/EKKOLearnAI/ekko-studio/commit/e65030bf26d12e1a523e773c5738af9ff61377ef
github.com
https://github.com/EKKOLearnAI/ekko-studio/issues/3057
www.vulncheck.com
https://www.vulncheck.com/advisories/ekko-studio-through-0.7.36-missing-authorization-via-api-auth-locked-ips
More from ekko-studio
5.4
CVE-2026-114379
EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion