CVE-2026-79667
Ech0 before 4.4.3 Authentication Bypass via Scope Enforcement
CVSS Score
7.6
EPSS Score
0.0%
EPSS Percentile
0th
Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token (least-privilege) restrictions on several privileged admin routes. Multiple privileged endpoints (e.g., /api/inbox, /api/panel/comments, /api/backup/export) omit scope checks and authorize based only on the user's admin role, and the backup export handler discards token scope metadata entirely. An attacker holding a deliberately limited (low-scope) admin access token can reach broader privileged functionality than intended, including reading the inbox and exporting a full database backup ZIP archive. Fixed in 4.4.3.
| CWE | CWE-285 |
| Vendor | lin-snow |
| Product | ech0 |
| Published | Aug 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for lin-snow ech0
Be the first to know when new high vulnerabilities affecting lin-snow ech0 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
Low
Affected Versions
lin-snow / Ech0
0 < 4.4.3