EKKOLearnAI CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM EKKOLearnAI CVE published 2026-10-16

CVE-2026-111679

CVE-2026-111679 is a missing authorization vulnerability in Ekko Studio versions up to 0.7.36. An authenticated non-super_admin user can list and clear server-wide login lockouts via the /api/auth/locked-ips endpoint. This allows attackers to send DELETE requests without an IP parameter to invoke unlockAll(), potentially disabling the login rate limiter during password guessing against super_admin accounts.