Ech0 EUVD-2026-65442

Exploitation requires possession of a valid admin-issued Ech0 access token - even one deliberately scoped to minimal permissions such as echo:read. The attacker must be able to make authenticated HTTPS requests to the target Ech0 instance's /api/panel/comments/* endpoint group. No special network position beyond standard HTTPS connectivity is needed (AV:N, AC:L). What limits exploitation: the attacker must already hold or have obtained a legitimate access token issued by an admin of the target instance; unauthenticated access is not possible since JWTAuthMiddleware still validates JWT integrity. The vulnerability does not affect session-token users, who already hold full authority. Scope is confined to comment moderation and comment system settings; arbitrary code execution, credential theft, and access to non-comment admin functions are not achievable through this flaw alone.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N) scores 7.0, with PR:H reflecting that a valid admin-issued access token is required. The provided PR:H metric warrants scrutiny: the GHSA advisory indicates that any admin-issued token - even one deliberately scoped to read-only - is sufficient, which some analysts would classify as PR:L rather than PR:H since no elevated-privilege token is specifically needed. Real-world risk is moderate-to-high for deployments that issue scoped access tokens to multiple operators or integrate Ech0 via API: a low-trust API consumer with a read-only token can silently approve or delete comments and reconfigure the comment subsystem. No EPSS score was provided in the source data, and this CVE is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. No public proof-of-concept has been identified. The attack is straightforward once a valid token is obtained, requiring only standard HTTP requests to known endpoint paths - low technical barrier for any insider or token-compromise scenario. The impact is limited to comment data integrity and system settings rather than code execution or credential exposure, which moderates the urgency slightly; however, any deployment where scoped tokens are issued to partially-trusted parties should treat remediation as time-sensitive.

An attacker who has legitimately obtained or stolen an admin-issued access token scoped only to echo:read sends a standard HTTP DELETE request to /api/panel/comments/:id or a PUT request to /api/panel/comments/settings, bypassing the scope enforcement that the rest of the application enforces. Because no proof-of-concept has been publicly released, exploitation currently requires knowledge of the endpoint structure (available from the open-source router code on GitHub) and possession of any valid access token for the target Ech0 instance.