Ekko Studio CVE-2026-111679

Requires the attacker to already possess valid credentials for a non-super_admin (low-privileged) account on an Ekko Studio instance at or below version 0.7.36 (PR:L - authenticated). No special configuration, feature toggle, or deployment mode is needed; the missing authorization check is present in the default routing of /api/auth/locked-ips, and sending a DELETE request with no ip parameter invokes unlockAll(). Limiting factors: exploitation yields no direct account takeover by itself - realized impact depends on a subsequent successful brute-force against super_admin once the rate limiter is disabled, and the attacker must first obtain a low-privileged foothold, which bounds this to insider or post-compromise scenarios rather than fully external unauthenticated attack.

This is a medium-severity authorization flaw whose signals are consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, base 5.3) indicates a network-reachable, low-complexity attack that nonetheless REQUIRES an authenticated account (PR:L), so this is not an unauthenticated internet-facing break. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public proof-of-concept is referenced - therefore there is no public exploit identified at time of analysis. The practical danger is indirect: the flaw itself only yields low confidentiality/integrity impact (reading and clearing lockout state, VC:L/VI:L/VA:N), but it DEGRADES a security control (the login rate limiter) and thereby enables a follow-on credential brute-force against super_admin accounts. Net assessment: a legitimate but second-tier priority - meaningful for defense-in-depth and insider/post-compromise scenarios, but not a drop-everything issue given the authentication prerequisite, absence of known exploitation, and reliance on a successful subsequent password-guessing attack to realize real harm.

An attacker who already holds any low-privileged (non-super_admin) Ekko Studio account sends a DELETE request to /api/auth/locked-ips with no ip parameter, triggering unlockAll() and wiping all server-wide login lockouts. With the rate limiter neutralized, the attacker repeatedly runs an automated password-guessing campaign against super_admin login, re-clearing lockouts whenever they accumulate. No public exploit code is referenced, but the attack is low-complexity (AC:L) once a basic authenticated session exists.