Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111679Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips

Medium 5.4

In plain English

A medium-severity missing authorization in ekko-studio from EKKOLearnAI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 87.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll(), disabling the login rate limiter during password guessing against super_admin accounts.

Affected products (as reported)

Vendor	Product	Versions
EKKOLearnAI	ekko-studio	0 – through 0.7.36

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/EKKOLearnAI/ekko-studio/issues/3057 issue-tracking
https://github.com/EKKOLearnAI/ekko-studio/blob/v0.7.36/packages/server/src/modules/studio/routes/auth.ts#L26-L27 technical-description
https://github.com/EKKOLearnAI/ekko-studio/blob/v0.7.36/packages/server/src/modules/studio/controllers/auth.ts#L807-L822 technical-description
https://github.com/EKKOLearnAI/ekko-studio/commit/e65030bf26d12e1a523e773c5738af9ff61377ef patch
VulnCheck Advisory: Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips third-party-advisory