What is CVE-2026-75773?

CVE-2026-75773 is a low-severity vulnerability in Karakeep-App Karakeep, classified under Improper Restriction of Excessive Authentication Attempts. CVSS score: 3.7/10. Published 2026-08-18.

How severe is CVE-2026-75773?

Low severity. CVSS v3 base score is 3.7 out of 10.

Vulnerability in Karakeep-App Karakeep

CVE-2026-75773

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been made public and could be used. Upgrading to version 0.33.0 is sufficient to fix this issue. The patch is identified as f7d042971d0d2bcc7119654830cf1eb93eabbf24. It is advisable to upgrade the affected component.

Published 2026-08-18 · last modified 2026-08-20.

CVSS v3 metric

CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.

EPSS exploit prediction

EPSS: 0.007 (49.4th percentile), scored 2026-10-02.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 49.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.005 · newest: 0.007 · change: +0.001

Affected products

Karakeep-App Karakeep — versions 0.1, 0.10, 0.11

Weakness classification (CWE)

References

github.com/karakeep-app/karakeep/ (product)
github.com/karakeep-app/karakeep/commit/f7d042971d0d2bcc7119654830cf1eb93eabbf24 (patch)
github.com/karakeep-app/karakeep/issues/2919 (issue-tracking, exploit)
github.com/karakeep-app/karakeep/releases/tag/mcp/v0.33.0 (patch)
vuldb.com/cve/CVE-2026-75773 (third-party-advisory)
vuldb.com/submit/877731 (third-party-advisory)
vuldb.com/vuln/391519 (technical-description, vdb-entry)
vuldb.com/vuln/391519/cti (signature, permissions-required)

Frequently asked questions

What is CVE-2026-75773?: CVE-2026-75773 is a low-severity vulnerability in Karakeep-App Karakeep, classified under Improper Restriction of Excessive Authentication Attempts. CVSS score: 3.7/10. Published 2026-08-18.
How severe is CVE-2026-75773?: Low severity. CVSS v3 base score is 3.7 out of 10.