Vulnerability Description
Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emails, and subscribe to live WebSocket logs by sending authenticated session tokens to unprotected endpoints.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/lin-snow/Ech0/security/advisories/GHSA-hmmq-qh6g-6wgh
- https://www.vulncheck.com/advisories/ech0-before-authorization-bypass-via-sessio
- https://github.com/lin-snow/Ech0/security/advisories/GHSA-hmmq-qh6g-6wgh
FAQ
What is CVE-2026-79665?
CVE-2026-79665 is a vulnerability with a CVSS score of 8.8 (HIGH). Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. A...
How severe is CVE-2026-79665?
CVE-2026-79665 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-79665?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.