CVE-2026-79672 Ech0 before 4.4.3 Authentication Bypass via Comment Panel
Attackers with limited-scope tokens can bypass authorization to perform full comment moderation and modify settings in Ech0.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-79672?
CVE-2026-79672 is a high-severity missing authorization vulnerability in lin-snow Ech0, published on 25 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment system settings by directly accessing the unprotected panel endpoints.
Weakness: CWE-862
Which versions are affected by CVE-2026-79672?
3 open source packages ship an affected version, including github.com/lin-snow/ech0.
| Package | Affected | Fixed in |
|---|---|---|
github.com/lin-snow/ech0 Go | All versions | None |
github.com/lin-snow/ech0 Go | All versions | 4.4.3 |
github.com/lin-snow/ech0 Go | All versions | 4.4.3 |
How do I fix CVE-2026-79672?
Upgrade github.com/lin-snow/ech0 to 4.4.3 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-79672 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-79672 exists.
Sources
Also known as GHSA-fwg7-53p4-g33c, GHSA-x98j-gh4v-7p7g, GO-2026-5382.