CVE-2026-79665: Ech0 before 4.5.1 Authorization Bypass via Session Tokens
Published Aug 25, 2026
·Updated
Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emails, and subscribe to live WebSocket logs by sending authenticated session tokens to unprotected endpoints.
Affected Software
1 affected component
Ech0<4.5.1
Event History
Aug 25, 2026
CVE Published
via MITRE·11:33 AM
Data Sourced
via MITRE·11:33 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require administrator access or user interaction?
No. The attack can be performed remotely without user interaction by a logged-in non-admin user using an authenticated session token; the CVSS vector indicates low privileges are required.
2
What could a successful attacker access?
A successful attacker may access administrative endpoints to read system logs, visitor statistics, and user email addresses, and may subscribe to live WebSocket log streams.