CVE-2026-111679 Details

A missing authorization vulnerability exists in Ekko Studio versions through 0.7.36, allowing any authenticated user who is not a super admin to manage server-wide login lockouts. The vulnerability is accessible via the '/api/auth/locked-ips' endpoint, where users can list currently locked IPs and their failure counts. More critically, users can send DELETE requests to the same endpoint without specifying an IP address, which triggers the 'unlockAll()' function. This action disables the login rate limiter that protects against password guessing attacks, particularly targeting super admin accounts. The issue arises because the routes for managing locked IPs do not require super admin privileges, unlike other user management routes.

Users can be advised to update to Ekko Studio version 0.7.37 or later, where this vulnerability has been addressed.