CVE-2026-79673

Name of the Vulnerable Software and Affected Versions Ech0 versions prior to 4.4.3

Description The 'PUT /user' endpoint is incorrectly protected by the profile:read scope, which is intended for read-only access. This allows an attacker possessing a token with profile:read permissions to perform write operations, such as changing an administrator's password. By doing so, the attacker can log in to obtain an unrestricted session token that bypasses all scope enforcement.

Recommendations Update to version 4.4.3 or later. As a temporary mitigation, restrict access to the 'PUT /user' endpoint.