{"id":"CVE-2026-111679","summary":"Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips","details":"Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll(), disabling the login rate limiter during password guessing against super_admin accounts.","modified":"2026-10-17T02:49:08.519914469Z","published":"2026-10-16T17:39:38.049Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111679.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111679.json"},{"type":"PACKAGE","url":"https://github.com/EKKOLearnAI/ekko-studio"},{"type":"ARTICLE","url":"https://github.com/EKKOLearnAI/ekko-studio/blob/v0.7.36/packages/server/src/modules/studio/controllers/auth.ts#L807-L822"},{"type":"ARTICLE","url":"https://github.com/EKKOLearnAI/ekko-studio/blob/v0.7.36/packages/server/src/modules/studio/routes/auth.ts#L26-L27"},{"type":"FIX","url":"https://github.com/EKKOLearnAI/ekko-studio/commit/e65030bf26d12e1a523e773c5738af9ff61377ef"},{"type":"REPORT","url":"https://github.com/EKKOLearnAI/ekko-studio/issues/3057"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111679"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/ekko-studio-through-0.7.36-missing-authorization-via-api-auth-locked-ips"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ekkolearnai/ekko-studio","events":[{"introduced":"0"},{"last_affected":"1242ac63556491c92ba6dd49d89fd19c91a6bdd5"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0"},{"last_affected":"0.7.36"}]}}],"versions":["v0.7.36","hermes-0.22.2-runtime","v0.7.35","v0.7.34","v1.0.7","v0.7.33","v0.7.32","v0.7.31","v0.7.30","v0.7.29","v0.7.28","v1.0.6","v0.7.27","v0.7.26","v1.0.5","v0.7.25","hermes-0.21.5-runtime","v0.7.24","v1.0.4","v0.7.23","v0.7.22","hermes-0.21.3-runtime","v0.7.21","v0.7.20","v0.7.19","v1.0.3","v1.0.2","v0.7.18","v0.7.17","hermes-0.21.0-runtime","v1.0.1","v0.7.16","v0.7.15","v0.7.14","v0.7.13","v0.7.12","v0.7.11","v0.7.1","v0.7.0","hermes-0.20.6-runtime","v0.6.47","v0.6.46","v0.6.45","hermes-0.20.4-runtime","v0.6.44","v0.6.43","v1.0.0","v0.6.42","v0.6.40","stt-zipformer-bilingual-zh-en-int8-2023-02-20","v0.6.39","v0.6.38","v0.6.37","hermes-0.20.0-runtime","hermes-0.19.1-runtime","v0.6.36","v0.6.35","v0.6.34","v0.6.33","v0.6.32","hermes-0.19.0-runtime","v0.6.31","v0.6.30","v0.6.29","hermes-0.18.2-runtime","v0.6.28","v0.6.27","v0.6.26","v0.6.25","v0.6.24","hermes-0.18.0-runtime","v0.6.23","v0.6.22","v0.6.21","v0.6.20","v0.6.19","v0.6.18","hermes-0.17.0-runtime","0.17.0","v0.6.15","v0.6.14","v0.6.13","v0.6.12","hermes-0.16.0-runtime","hermes-0.15.2-runtime-test","v0.6.11","v0.6.10","v0.6.10-beta","v0.6.9","0.6.8-beta-2","hermes-0.15.2-runtime","0.6.8-beta","v0.6.7","v0.6.6","v0.6.5","v0.6.4","v0.6.3","v0.6.2","v0.6.1","v0.6.0","0.5.35","0.5.34","0.5.33","v0.5.32","v0.5.30","v0.5.28","v0.5.25","v0.5.24","v0.5.23","v0.5.22","v0.5.21","v0.5.20","v0.5.18","v0.5.17","v0.5.16","v0.5.15","v0.5.13","v0.5.12","v0.5.10","v0.5.9","v0.5.8","v0.5.7","v0.5.6","v0.5.5","v0.5.4","v0.5.3","v0.5.2","v0.4.6","v0.4.5","0.4.4","v0.4.2","v0.4.1","0.3.8","v0.3.7","v0.3.6","v0.3.5","0.3.1","0.3.0","v0.2.5","0.2.3","v0.2.0","v0.2.0-beta.1","v0.1.9","v0.1.5","v0.1.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111679.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}