CVE-2026-79665
Received Received - Intake

Authorization Bypass in Ech0 via Session Token Scope Validation

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emails, and subscribe to live WebSocket logs by sending authenticated session tokens to unprotected endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-79665
EUVD
EUVD-2026-65449

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in Ech0 versions before 4.5.1. The RequireScopes middleware fails to validate session tokens properly, allowing non-admin users to access admin endpoints. Attackers can exploit this to read system logs, visitor statistics, user emails, and subscribe to live WebSocket logs by sending authenticated session tokens to unprotected endpoints.

Detection Guidance

Check Ech0 version with 'curl -s http://<ech0-server>/api/version' or 'ech0 --version'. If version is below 4.5.1, the system is vulnerable. Inspect network traffic for requests to admin endpoints like /api/system/logs, /api/users, or /ws/system/logs with session tokens.

Impact Analysis

If you use Ech0 before version 4.5.1, unauthorized users may access sensitive data like system logs, visitor statistics, and user emails. Attackers could also subscribe to live WebSocket logs, exposing internal system operations. This could lead to data breaches, privacy violations, and unauthorized system access.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal data (user emails) and sensitive system logs. GDPR requires protecting personal data, while HIPAA mandates safeguarding health-related information. Exploitation may result in data breaches, triggering regulatory fines and legal consequences.

Mitigation Strategies

Upgrade Ech0 to version 4.5.1 or later immediately. Ensure all admin endpoints enforce scope validation and IsAdmin checks. Review WebSocket and HTTP endpoint configurations to confirm middleware applies to session tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79665. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart