CVE-2026-111679: Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips

Q: Who can exploit this issue?

Any authenticated Ekko Studio user who is not a super_admin can exploit it. The attacker needs network access to the affected API endpoint and valid low-privilege credentials; no user interaction is required.

Q: What does exploitation allow an attacker to do?

An attacker can list server-wide login lockouts and clear them. Sending a DELETE request to /api/auth/locked-ips without an ip parameter invokes unlockAll(), disabling the login rate limiter for password-guessing attempts against super_admin accounts.

Q: Are systems affected only under a particular configuration?

The affected behavior is tied to the /api/auth/locked-ips endpoint and its authorization handling. The provided information does not identify a configuration prerequisite beyond having authenticated non-super_admin users able to reach the endpoint.

Q: How can defenders look for attempted exploitation?

Review API logs for DELETE requests to /api/auth/locked-ips, particularly requests without an ip parameter, from non-super_admin accounts. Also investigate unexpected clearing of login lockouts and elevated failed login attempts targeting super_admin accounts.

Published Oct 16, 2026

Updated

Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-superadmin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll(), disabling the login rate limiter during password guessing against superadmin accounts.

Affected Software

1 affected component

Ekko Studio Ekko Studio<=0.7.36

Event History

Oct 16, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated Ekko Studio user who is not a super_admin can exploit it. The attacker needs network access to the affected API endpoint and valid low-privilege credentials; no user interaction is required.

What does exploitation allow an attacker to do?

An attacker can list server-wide login lockouts and clear them. Sending a DELETE request to /api/auth/locked-ips without an ip parameter invokes unlockAll(), disabling the login rate limiter for password-guessing attempts against super_admin accounts.

Are systems affected only under a particular configuration?

The affected behavior is tied to the /api/auth/locked-ips endpoint and its authorization handling. The provided information does not identify a configuration prerequisite beyond having authenticated non-super_admin users able to reach the endpoint.

How can defenders look for attempted exploitation?

Review API logs for DELETE requests to /api/auth/locked-ips, particularly requests without an ip parameter, from non-super_admin accounts. Also investigate unexpected clearing of login lockouts and elevated failed login attempts targeting super_admin accounts.

CVE-2026-111679: Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What does exploitation allow an attacker to do?

Are systems affected only under a particular configuration?

How can defenders look for attempted exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does exploitation allow an attacker to do?

Are systems affected only under a particular configuration?

How can defenders look for attempted exploitation?