CVE-2026-79672
Received Received - Intake

Ech0 Comment Panel Admin Endpoint Authorization Bypass

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment system settings by directly accessing the unprotected panel endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-79672
EUVD
EUVD-2026-65442

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ech0 comment_panel to 4.4.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Ech0 before version 4.4.3 has a vulnerability where nine admin endpoints for comment moderation lack proper authorization checks. Attackers with limited-scope access tokens can bypass intended restrictions and perform unauthorized actions like listing, approving, rejecting, deleting comments, and modifying comment system settings by directly accessing these unprotected endpoints.

Detection Guidance

Check if your Ech0 instance is running a version before 4.4.3 by inspecting the version in the application or logs. Review access logs for unusual activity on endpoints under /api/panel/comments/*. Use tools like curl to test endpoints for unauthorized access with limited-scope tokens.

Impact Analysis

This vulnerability allows attackers with minimal access to gain unauthorized control over comment systems. They could expose sensitive data like PII, alter system configurations including SMTP settings, or manipulate comments without proper permissions. This could lead to data breaches, misinformation, or system misuse.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using vulnerable Ech0 versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches or unauthorized data exposure.

Mitigation Strategies

Upgrade Ech0 to version 4.4.3 or later. Ensure all comment panel admin endpoints under /api/panel/comments/* enforce scope-based authorization by adding RequireScopes middleware. Review and restrict access tokens to only necessary scopes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79672. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart