Ech0

Ech0 versions prior to 4.5.1 are vulnerable to an authorization bypass in the RequireScopes middleware, allowing non-admin users to access sensitive administrative functions.

Ech0's access tokens with the 'never expire' option cannot be revoked through logout or deletion, leading to persistent access until the JWT secret is rotated instance-wide.

Ech0 scoped access tokens do not reliably enforce least privilege, leading to privilege escalation and data exfiltration by allowing low-scope admin tokens to access broader admin functionality, including backup exports.