Authorization Bypass Vulnerability in Ech0

Ech0 versions prior to 4.5.1 contain a critical authorization bypass vulnerability (CVE-2026-79665) stemming from insufficient validation of session tokens within the application's 'RequireScopes' middleware. This flaw effectively permits authenticated, non-privileged users to circumvent intended access controls and interact with administrative endpoints.

By leveraging existing session tokens, an attacker can access sensitive information including system logs, visitor statistics, and user email addresses. Furthermore, the vulnerability allows for the subscription to live WebSocket logs, providing a mechanism for real-time reconnaissance or data exfiltration. This vulnerability poses a significant risk to the confidentiality and integrity of the application, as it grants administrative-level access without the appropriate scope or permission level. The vulnerability is assigned to the 'lin-snow' organization.

Impact

The impact of this vulnerability includes the unauthorized exposure of system logs, internal visitor statistics, and user emails. Furthermore, the ability to subscribe to live WebSocket logs enables an attacker to monitor application traffic and activity in real time. This unauthorized access can lead to significant data breaches and internal system discovery, compromising the overall security of the Ech0 deployment.

Recommendation

• Upgrade all instances of Ech0 to version 4.5.1 or later to remediate CVE-2026-79665.
• Review web server access logs for anomalous requests to administrative endpoints originating from non-admin user sessions.
• Monitor for unusual patterns in WebSocket traffic or unauthorized subscription attempts to system log streams.
• Review user roles and privileges to ensure that sessions currently in use do not hold excessive permissions.