EUVD-2026-65449
GHSA-q8hh-m6v5-4f3x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as any Ech0 user
-
DeliveryCapture valid session token
-
ExploitIdentify admin API routes from open-source route definitions
-
ExecutionSend session token to unprotected admin endpoints
-
PersistRequireScopes middleware skips scope check
-
ImpactExfiltrate system logs, user emails, and live WebSocket log stream
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated session token issued to any user account on the Ech0 instance, regardless of role (PR:L). The attacker must know or discover the URL paths of admin endpoints - a moderate but not prohibitive reconnaissance step given Ech0 is open-source and route definitions are publicly visible in the repository. No special platform configuration is required; the flaw is present in default deployments of any Ech0 version before 4.5.1. Exploitation is limited to users who can authenticate: deployments that restrict registration to trusted individuals or have no user accounts beyond the administrator significantly reduce practical risk. Remote unauthenticated attackers without a valid session cannot exploit this vulnerability. |
| Impact | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7, reflecting network accessibility and high impact across all three pillars. PR:L confirms exploitation requires an authenticated session, which is a meaningful barrier in closed deployments. However, the VI:H and VA:H ratings appear inflated relative to the described capabilities - the advisory specifically lists read operations (logs, statistics, emails, WebSocket streams) with no mention of write or delete primitives. This analyst assesses the integrity and availability impacts as unconfirmed by available data. No EPSS score was provided; the absence of KEV listing and POC reduces urgent triage priority, but the low complexity and broad network vector mean any authenticated user in a shared Ech0 instance could immediately exploit this. The primary real-world risk is data exfiltration of user PII (email addresses) and operational intelligence (system logs, live log streams). |
| Exploit ScenarioDerived | An attacker registers or logs into Ech0 as a standard non-admin user and obtains a valid session token. They then craft direct HTTP requests - or open a WebSocket connection - to admin-only API routes (e.g., log retrieval, user list, live log stream), supplying the session token in the authorization header. The RequireScopes middleware passes the token without evaluating its scope, and the server returns privileged data including system logs and registered user email addresses. No public POC has been identified, but the attack requires only standard HTTP tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Authorization bypass in Ech0 before 4.5.1 allows any authenticated non-admin user to invoke privileged admin endpoints by sending a valid session token to routes unprotected by the RequireScopes middleware. Affected instances expose system logs, visitor statistics, user email addresses, and live WebSocket log streams to any logged-in user regardless of their assigned role. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and network accessibility make this a realistic threat in any multi-user Ech0 deployment.
RemediationAI
Upgrade Ech0 to version 4.5.1 or later, which resolves the missing scope validation in the RequireScopes middleware. The vendor security advisory is published at https://github.com/lin-snow/Ech0/security/advisories/GHSA-hmmq-qh6g-6wgh and should be consulted for release notes. If immediate upgrade is not possible, a compensating control is to restrict application access to trusted, role-vetted users only - removing self-registration or disabling general user accounts reduces the attacker pool. Network-layer controls (e.g., placing Ech0 behind a VPN or IP allowlist) can further limit exposure to unauthenticated external parties, though these do not address exploitation by already-authenticated insiders.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Ech0 (CPE: cpe:2.3:a:lin-snow:ech0:*:*:*:*:*:*:*:*) is an open-source web application developed by lin-snow that exposes HTTP and WebSocket endpoints for blogging or content management. The application uses a RequireScopes middleware layer intended to restrict admin-level routes to appropriately scoped session tokens. CWE-862 (Missing Authorization) describes exactly this flaw class: a code path exists that should enforce an authorization check but does not. Here, session tokens are validated for authenticity but their embedded scope claims are never evaluated on admin routes, meaning any valid token - regardless of privilege level - satisfies the middleware and proceeds to the protected handler.
Know when Ech0 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network vector, low complexity; PR:L for required session; only read impact confirmed by description, so I:N and A:N.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emails, and subscribe to live WebSocket logs by sending authenticated session tokens to unprotected endpoints.
Executive ViewAI
Ech0 versions prior to 4.5.1 contain an authorization bypass that exposes confidential data including system logs and employee email addresses to any user with Ech0 access, regardless of their assigned permissions. This privilege escalation creates internal security breaches where employee data and operational information become visible to staff who should not have access. Any organization using Ech0 across multiple departments faces immediate risk of unauthorized data exposure.
No vendor-released patch identified at time of analysis; no public exploit identified at time of analysis. Implement network-layer access controls via firewall rules, WAF, or reverse proxy to restrict administrative endpoint access to verified administrator accounts only; enforce mandatory MFA for all Ech0 user accounts; isolate Ech0 instances to trusted networks via network segmentation; and establish enhanced logging and real-time alerting for administrative endpoint access attempts to detect unauthorized privilege escalation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Persistent authentication bypass in Ech0 (lin-snow's self-hosted lightweight publishing/memo app) before 4.7.3 lets an a
OAuth redirect URI validation in Ech0 through 4.5.6 allows session hijacking via exchange-code theft by exploiting incom
Denial of service in Ech0 before 5.0.1 allows unauthenticated remote attackers to saturate server CPU by exploiting a qu
Privilege escalation in Ech0 before 4.4.3 allows an attacker holding an admin's profile:read access token to change the
Server-side request forgery in Ech0 before version 4.7.3 allows authenticated users to pivot through the application ser
Scope enforcement in Ech0 4.3.4 and earlier is opt-in at the route level, meaning privileged admin routes that omit the
Missing administrator authorization on dashboard log endpoints in Ech0 before 4.4.3 allows any authenticated low-privile
Scope enforcement bypass in Ech0's comment panel admin API allows any holder of a valid admin-issued access token - rega
Unauthenticated metric inflation in Ech0 before 4.7.3 allows any remote attacker to arbitrarily increment the fav_count
Unauthenticated remote attackers can increment the fav_count of any echo - including private ones - in Ech0 through 4.5.
Ech0 before version 4.7.3 exposes guest commenter email addresses to unauthenticated remote callers via public comment-l
Unsalted MD5 password hashing in Ech0's `MD5Encrypt` function (`internal/util/crypto/crypto.go`) stores credentials in a
Exploit-DB