PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-79667 lin-snow CVE debrief

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token (least-privilege) restrictions on several privileged admin routes. Multiple privileged endpoints (e.g., /api/inbox, /api/panel/comments, /api/backup/export) omit scope checks and authorize based only on the user's admin role, and the backup export handler discards token scope metadata entirely. An attacker holding a deliberately limited (low-scope) admin access token can reach broader privileged functionality than intended, including reading the inbox and exporting a full database backup ZIP archive. The vulnerability was publicly disclosed and fixed in version 4.4.3. Administrators and security teams should review and update Ech0 installations to mitigate this HIGH-rated vulnerability with a CVSS score of 7.2.

Vendor
lin-snow
Product
Ech0
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-25
Original CVE updated
2026-08-31
Advisory published
2026-08-25
Advisory updated
2026-08-31

Who should care

Administrators and security teams responsible for Ech0 installations, particularly those with high-privilege access, should prioritize updating to version 4.4.3 or later to mitigate this vulnerability.

Technical summary

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token restrictions on several privileged admin routes. Multiple endpoints, such as /api/inbox, /api/panel/comments, and /api/backup/export, omit scope checks and authorize based solely on the user's admin role. The backup export handler discards token scope metadata entirely, allowing an attacker with a deliberately limited admin access token to access broader privileged functionality than intended.

Defensive priority

CVE-2026-79667 is rated HIGH with a CVSS score of 7.2; Ech0 version 4.3.4 and earlier are affected; attackers with deliberately limited admin access tokens can reach broader privileged functionality than intended.

Recommended defensive actions

  • Review and update Ech0 to version 4.4.3 or later
  • Implement strict scope checks for all privileged admin routes
  • Restrict access to sensitive endpoints based on user role and token scope
  • Monitor for and respond to potential exploitation attempts
  • Conduct thorough inventory checks for affected systems

Evidence notes

The CVE-2026-79667 details indicate that multiple privileged endpoints in Ech0 version 4.3.4 and earlier omit scope checks and authorize based only on the user's admin role. The backup export handler discards token scope metadata entirely. An attacker with a deliberately limited admin access token can access broader privileged functionality, including reading the inbox and exporting a full database backup ZIP archive.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-79667 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-79667

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-79667 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-79667

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.