Ech0 CVE-2026-79673

Exploitation requires possession of a valid profile:read access token issued for an admin user account - not a general user token. The PUT /user handler additionally checks user.IsAdmin at the service layer, so the token must be associated with an admin account; tokens for non-admin accounts are rejected before reaching the password-change logic. The attacker must have network access to both the PUT /user and POST /login endpoints. The scope bypass to an unrestricted session token only materializes after successful login, which requires the password change to succeed first. Limiting factors: the attacker cannot self-issue an access token - they must obtain one belonging to an admin through a separate compromise (token theft, misconfigured token distribution, or insider threat). Ech0 instances that have never issued profile:read access tokens, or that issue them only to fully trusted internal systems with no external exposure, are not exploitable by external attackers.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N) accurately reflects the prerequisites: network-accessible exploitation with no complexity once the required credential is held, but High privileges required - the attacker must already possess a valid admin-issued profile:read access token. This is not an unauthenticated or low-privilege exploit; the initial access barrier is meaningful. However, if profile:read tokens are distributed for monitoring integrations or delegated access, that pool of token holders represents the real attack surface. Post-exploitation impact is maximal: full admin session token granting access to admin:settings, admin:user, admin:token, and file:write scopes. No EPSS data was provided in the input, and the vulnerability is not listed in CISA KEV, suggesting no confirmed widespread exploitation. A PoC is publicly documented in GHSA-hm2h-wwwh-g49x. Deployments that do not issue profile:read tokens to untrusted parties face substantially reduced real-world risk despite the high CVSS score.

An attacker who has obtained an admin's profile:read access token - via token leakage, insider access, or credential theft from an integration - sends a crafted PUT /user HTTP request bearing that token and a new password field. The RequireScopes middleware accepts the request because the token contains profile:read, the handler changes the admin account password, and the attacker immediately authenticates via POST /login to receive a session token. A proof-of-concept demonstrating this chain is documented in the GHSA advisory.