CVE-2026-79665

Name of the Vulnerable Software and Affected Versions Ech0 versions prior to 4.5.1

Description An authorization bypass occurs because session tokens skip scope validation within the RequireScopes middleware. This allows authenticated users without administrative privileges to access administrative endpoints. By providing authenticated session tokens, attackers can retrieve system logs, visitor statistics, and user emails, as well as subscribe to live WebSocket logs.

Recommendations Update to version 4.5.1 or later.