CVE-2026-79673: Ech0 before 4.4.3 Scope Bypass via profile:read Token
Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An attacker with an admin's profile:read access token can change the admin's password and login to obtain an unrestricted session token that bypasses all scope enforcement.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ech0to a version that resolves this vulnerability.Fixed in 4.4.3Patch Ech0 before 4.4.3 Scope Bypass via profile:read Token - Compensating control
Restrict access to the PUT /user endpoint to requests that cannot be made with a token limited to the profile:read scope (e.g., enforce scope/permission checks server-side for write operations such as password changes).
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs a profile:read access token belonging to an administrator. No user interaction is required, and the vulnerable endpoint is reachable over the network.
What can an attacker do with the affected token?
They can use the token to send write requests to PUT /user, including changing the administrator's password. They can then log in with the new password to obtain an unrestricted session token that bypasses scope enforcement.
Which versions should be remediated?
Ech0 versions before 4.4.3 are affected. Upgrade to 4.4.3 or later.