VYPR
← All advisories
High severity8.8NVD Advisory· Published Aug 25, 2026· Updated Aug 31, 2026

CVE-2026-79665

CVE-2026-79665

Description

Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emails, and subscribe to live WebSocket logs by sending authenticated session tokens to unprotected endpoints.

Affected products

2
  • Lin Snow/Ech0inferred2 versions
    <4.5.1+ 1 more
    • (no CPE)range: <4.5.1
    • (no CPE)range: <4.5.1

Patches

Vulnerability mechanics

References

2

News mentions

1