CVE-2026-75773
Received Received - Intake

Improper Authentication in Karakeep Application

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulDB

Description
A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. Upgrading to version 0.33.0 is sufficient to fix this issue. The patch is identified as f7d042971d0d2bcc7119654830cf1eb93eabbf24. It is advisable to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-75773
EUVD
EUVD-2026-60580

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
karakeep-app karakeep to 0.32.0 (inc)
karakeep-app karakeep From 0.33.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
CWE-799 The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper restriction of excessive authentication attempts in the Karakeep application up to version 0.32.0. The login endpoint's authorize function in apps/web/server/auth.ts lacks brute-force protection, allowing unlimited password guesses without rate limiting or lockout mechanisms. Attackers can exploit this remotely with high complexity but difficult exploitability.

Detection Guidance

To detect this vulnerability, monitor login attempts to the Karakeep application. Check for unusually high numbers of failed login attempts from the same IP address or email within a short timeframe. Use tools like fail2ban to track failed attempts or review server logs for repeated authentication failures.

Impact Analysis

An attacker could perform brute-force or credential-stuffing attacks against any known email address in your Karakeep instance. Weak or reused passwords may be compromised even with bcrypt hashing. The attack requires no authentication and could lead to unauthorized access to user accounts and sensitive data like bookmarks or notes.

Compliance Impact

This vulnerability could violate data protection requirements under GDPR and HIPAA by failing to implement adequate security controls to protect personal data. Unauthorized access risks breaches of user data, potentially leading to regulatory penalties for insufficient safeguards against brute-force attacks.

Mitigation Strategies

Upgrade Karakeep to version 0.33.0 or later to apply the rate-limiting patch. If upgrading is not immediately possible, manually implement rate limiting for login attempts (e.g., 10 requests per 15 minutes per IP/email). Enable CAPTCHA and failed-attempt lockout mechanisms for the login endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75773. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart