CVE-2026-111679
Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user to list and cle
CVSS
5.4
Média
EPSS
0.2%
p13
KEV
—
Exploit Today
4
0-100
Publicado: 16 de out. de 2026 · Última mod.: 21 de out. de 2026 · CWE-862
0.2%EPSS · 30 dias0.2%
2026-10-172026-11-06
Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll(), disabling the login rate limiter during password guessing against super_admin accounts.
- github.comhttps://github.com/EKKOLearnAI/ekko-studio/blob/v0.7.36/packages/server/src/modules/studio/controllers/auth.ts#L807-L822
- github.comhttps://github.com/EKKOLearnAI/ekko-studio/blob/v0.7.36/packages/server/src/modules/studio/routes/auth.ts#L26-L27
- github.comhttps://github.com/EKKOLearnAI/ekko-studio/commit/e65030bf26d12e1a523e773c5738af9ff61377ef
- github.comhttps://github.com/EKKOLearnAI/ekko-studio/issues/3057
- www.vulncheck.comhttps://www.vulncheck.com/advisories/ekko-studio-through-0.7.36-missing-authorization-via-api-auth-locked-ips
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1234745.3 MÉD—
———Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from n/a through 2.3.18.4hCVE-2026-1234674.3 MÉD—
———Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.128.4hCVE-2026-1234625.3 MÉD—
———Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.4hCVE-2026-1226635.3 MÉD—
———Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.20.4hCVE-2026-1226604.3 MÉD—
———Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FloristPress: from n/a through 7.8.5.4hCVE-2026-1226595.4 MÉD—
———Missing Authorization vulnerability in WP ManageNinja LLC Fluent Booking fluent-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Booking: from n/a through 2.5.0.4h