PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111679 EKKOLearnAI CVE debrief

CVE-2026-111679 is a missing authorization vulnerability in Ekko Studio versions up to 0.7.36. An authenticated non-super_admin user can list and clear server-wide login lockouts via the /api/auth/locked-ips endpoint. This allows attackers to send DELETE requests without an IP parameter to invoke unlockAll(), potentially disabling the login rate limiter during password guessing against super_admin accounts.

Vendor
EKKOLearnAI
Product
ekko-studio
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-16
Original CVE updated
2026-10-21
Advisory published
2026-10-16
Advisory updated
2026-10-21

Who should care

System administrators and security teams responsible for Ekko Studio deployments should assess exposure and implement mitigations. They should verify their version of Ekko Studio and review authentication and authorization mechanisms. Security teams should also monitor for suspicious activity on the /api/auth/locked-ips endpoint and implement compensating controls for login rate limiting.

Why it matters

CVE-2026-111679 is a medium-severity vulnerability in Ekko Studio that allows authenticated users to list and clear server-wide login lockouts. This could be used to facilitate password guessing attacks against super_admin accounts. System administrators and security teams should assess exposure, verify versions, and implement compensating controls.

  • Potential bypass of login rate limiting during password guessing attacks
  • Increased risk of unauthorized access to super_admin accounts
  • Need for verification of affected versions and exposure
  • Potential impact on authentication security posture

Technical summary

The vulnerability allows an authenticated non-super_admin user to list and clear server-wide login lockouts via the /api/auth/locked-ips endpoint. This could be used to disable the login rate limiter during password guessing attacks against super_admin accounts. The vulnerability is present in Ekko Studio versions up to 0.7.36. Affected deployments should assess exposure and implement mitigations. The CVE record and source item provide details on the vulnerability, but further verification is required to determine the full scope of affected versions and potential impact.

Defensive priority

Medium priority for authentication and authorization review

Recommended defensive actions

  • Review authentication and authorization mechanisms for Ekko Studio
  • Verify version 0.7.36 or earlier is in use and assess exposure
  • Implement compensating controls for login rate limiting
  • Monitor for suspicious activity on /api/auth/locked-ips endpoint
  • Review vendor patch guidance for Ekko Studio
  • Perform exposure review for Ekko Studio deployments
  • Implement asset inventory for Ekko Studio

Evidence notes

The CVE record and source item provide details on the vulnerability. However, the scope of affected versions and potential impact requires further verification from official sources. Affected Ekko Studio deployments should verify their version and assess exposure. The vulnerability allows an authenticated non-super_admin user to list and clear server-wide login lockouts via the /api/auth/locked-ips endpoint. This could be used to disable the login rate limiter during password guessing attacks against super_admin accounts. Ekko Studio

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111679 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111679

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111679 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111679

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111679.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/EKKOLearnAI/ekko-studio/issues/3057

    Supplemental source - issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/EKKOLearnAI/ekko-studio/blob/v0.7.36/packages/server/src/modules/studio/routes/auth.ts

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/EKKOLearnAI/ekko-studio/blob/v0.7.36/packages/server/src/modules/studio/controllers/auth.ts

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/EKKOLearnAI/ekko-studio/commit/e65030bf26d12e1a523e773c5738af9ff61377ef

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/ekko-studio-through-0.7.36-missing-authorization-via-api-auth-locked-ips

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.