Live › vulnerability › CVE-2026-111679
Go to dashboardEkko Studio through 0.7.36 lets any authenticated non-super_admin user list locked IP addresses and clear all login lockouts via /api/auth/locked-ips. An attacker can then disable the login rate limiter and guess super_admin passwords more freely.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or internal Ekko Studio deployments at version 0.7.36 or earlier that have more than one user account. Exposure depends on whether non-admin users can sign in. The sources do not name a patched version.
No product ranges from the sources yet.
0.7.36 or earlierUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll(), disabling the login rate limiter during password guessing against super_admin accounts.
This page as .md · .json · in your agent: get_signal("CVE-2026-111679")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.