EUVD-2026-65441
GHSA-6h3p-88p7-m8gp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires a valid admin-issued access token (PR:H); network vector with low complexity once token held; no availability impact and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An attacker with an admin's profile:read access token can change the admin's password and login to obtain an unrestricted session token that bypasses all scope enforcement.
AnalysisAI
Privilege escalation in Ech0 before 4.4.3 allows an attacker holding an admin's profile:read access token to change the admin's password via a misauthorized PUT /user endpoint, then authenticate to obtain an unrestricted session token that bypasses all scope enforcement. The CWE-863 root cause is a mismatch between the declared read-only scope on the route and the write operations the handler actually performs; session tokens produced after login skip scope checks entirely, granting full admin API access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires possession of a valid profile:read access token issued for an admin user account - not a general user token. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N) accurately reflects the prerequisites: network-accessible exploitation with no complexity once the required credential is held, but High privileges required - the attacker must already possess a valid admin-issued profile:read access token. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained an admin's profile:read access token - via token leakage, insider access, or credential theft from an integration - sends a crafted PUT /user HTTP request bearing that token and a new password field. The RequireScopes middleware accepts the request because the token contains profile:read, the handler changes the admin account password, and the attacker immediately authenticates via POST /login to receive a session token. … |
| Remediation | Upgrade Ech0 to version 4.4.3 or later, which contains the vendor-released patch for this issue as confirmed by Go package vulnerability data; the fix resolves the scope mismatch on PUT /user and corrects the session-token bypass in RequireScopes middleware. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Ech0 deployments and inventory instances running versions prior to 4.4.3, then audit all profile:read access tokens to document which users and systems hold them. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Persistent authentication bypass in Ech0 (lin-snow's self-hosted lightweight publishing/memo app) before 4.7.3 lets an a
OAuth redirect URI validation in Ech0 through 4.5.6 allows session hijacking via exchange-code theft by exploiting incom
Denial of service in Ech0 before 5.0.1 allows unauthenticated remote attackers to saturate server CPU by exploiting a qu
Authorization bypass in Ech0 before 4.5.1 allows any authenticated non-admin user to invoke privileged admin endpoints b
Server-side request forgery in Ech0 before version 4.7.3 allows authenticated users to pivot through the application ser
Scope enforcement in Ech0 4.3.4 and earlier is opt-in at the route level, meaning privileged admin routes that omit the
Missing administrator authorization on dashboard log endpoints in Ech0 before 4.4.3 allows any authenticated low-privile
Scope enforcement bypass in Ech0's comment panel admin API allows any holder of a valid admin-issued access token - rega
Unauthenticated metric inflation in Ech0 before 4.7.3 allows any remote attacker to arbitrarily increment the fav_count
Unauthenticated remote attackers can increment the fav_count of any echo - including private ones - in Ech0 through 4.5.
Ech0 before version 4.7.3 exposes guest commenter email addresses to unauthenticated remote callers via public comment-l
Unsalted MD5 password hashing in Ech0's `MD5Encrypt` function (`internal/util/crypto/crypto.go`) stores credentials in a
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today