CVE-2026-79667: Ech0 before 4.4.3 Authentication Bypass via Scope Enforcement
Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token (least-privilege) restrictions on several privileged admin routes. Multiple privileged endpoints (e.g., /api/inbox, /api/panel/comments, /api/backup/export) omit scope checks and authorize based only on the user's admin role, and the backup export handler discards token scope metadata entirely. An attacker holding a deliberately limited (low-scope) admin access token can reach broader privileged functionality than intended, including reading the inbox and exporting a full database backup ZIP archive. Fixed in 4.4.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ech0to a version that resolves this vulnerability.Fixed in 4.4.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Ech0 deployments running version 4.3.4 or earlier are affected if they use scoped admin access tokens. An attacker must possess an admin token that was intentionally limited to low-scope permissions.
What access can a low-scope admin token gain?
Affected routes authorize based on the admin role without reliably checking token scopes. This can allow access to privileged functions such as reading the inbox, accessing panel comments, and exporting a full database backup ZIP archive.
What version fixes the issue?
The issue is fixed in Ech0 4.4.3. Upgrade affected installations to that version or later.