Ech0 EUVD-2026-65447

The attacker must possess a valid admin-account access token for the target Ech0 instance - even one deliberately scoped to limited permissions such as echo:read. This restricts exploitation to: legitimate admin users who have been issued API tokens, attackers who have compromised or exfiltrated a limited admin token from storage (e.g., environment variables, CI/CD secrets, configuration files), or scenarios where delegated tokens are shared with third-party integrations. Fully unauthenticated exploitation is not possible - PR:L in the CVSS vector confirms credential requirement. No special server-side configuration beyond the default token-based authentication model is needed; the vulnerable behavior is present in the default state for any Ech0 deployment where admin access tokens have been issued. Non-admin users cannot exploit this vulnerability regardless of token scope.

The CVSS 4.0 score of 7.2 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L) accurately captures the threat model: network-accessible exploitation with low complexity, but bounded by the requirement for a valid admin-account access token. An unauthenticated external attacker cannot exploit this directly. The highest-impact pathway - full database backup exfiltration via /api/backup/export - represents a significant confidentiality breach for any deployment holding sensitive data. No EPSS score was provided in the input data, and no CISA KEV listing exists, meaning active exploitation in the wild is neither confirmed nor refuted by available signals. The GHSA advisory includes source code evidence and a detailed impact description, raising confidence that the vulnerability is exploitable as described. Practical risk is primarily an insider threat, lateral-movement-after-initial-access, or supply-chain token compromise scenario rather than mass internet exploitation.

An attacker who has obtained a low-scope admin API token - for instance, a CI/CD integration token intentionally scoped to echo:read - issues a direct HTTP GET request to /api/backup/export?token=<stolen_token> against the publicly reachable Ech0 instance. Because the backup export handler discards scope metadata before processing, the server validates only the admin role and returns a complete database backup ZIP archive containing all application data. No confirmed public exploit code exists, but the GHSA advisory documents the exact endpoint, parameter, and source-code path, making independent reproduction straightforward.