---
id: CVE-2026-111679
title: Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips
summary: >-
  Ekko Studio through 0.7.36 contains a missing authorization vulnerability that
  allows any authenticated non-super_admin user to list and clear server-wide
  login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests
  withou…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: EKKOLearnAI
product: ekko-studio
affected:
  - ekko-studio <= 0.7.36
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T17:39:38.049Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111679'
references:
  - url: 'https://github.com/EKKOLearnAI/ekko-studio/issues/3057'
  - url: >-
      https://github.com/EKKOLearnAI/ekko-studio/blob/v0.7.36/packages/server/src/modules/studio/routes/auth.ts#L26-L27
  - url: >-
      https://github.com/EKKOLearnAI/ekko-studio/blob/v0.7.36/packages/server/src/modules/studio/controllers/auth.ts#L807-L822
  - url: >-
      https://github.com/EKKOLearnAI/ekko-studio/commit/e65030bf26d12e1a523e773c5738af9ff61377ef
  - url: >-
      https://www.vulncheck.com/advisories/ekko-studio-through-0.7.36-missing-authorization-via-api-auth-locked-ips
    label: >-
      VulnCheck Advisory: Ekko Studio through 0.7.36 Missing Authorization via
      /api/auth/locked-ips
tags:
  - cve.org
ingestedAt: '2026-10-16T18:43:08.664Z'
---

## Overview

Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll(), disabling the login rate limiter during password guessing against super_admin accounts.

## Affected

- `ekko-studio <= 0.7.36`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.