CVE-2026-79667

Name of the Vulnerable Software and Affected Versions Ech0 versions prior to 4.4.3

Description The software fails to reliably enforce scoped access token restrictions on several privileged admin routes, violating the principle of least-privilege. Multiple privileged endpoints, including '/api/inbox', '/api/panel/comments', and '/api/backup/export', authorize requests based solely on the user's admin role while omitting scope checks. Additionally, the backup export handler completely discards token scope metadata. This allows an attacker with a limited low-scope admin access token to access broader privileged functionality, such as reading the inbox and exporting a full database backup ZIP archive.

Recommendations Update to version 4.4.3.