CVE-2026-79673 Ech0 before 4.4.3 Scope Bypass via profile:read Token
Attackers with read-only tokens can modify admin passwords, leading to full account takeover and bypassing scope restrictions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-79673?
CVE-2026-79673 is a high-severity missing authorization vulnerability in lin-snow Ech0, published on 25 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An attacker with an admin's profile:read access token can change the admin's password and login to obtain an unrestricted session token that bypasses all scope enforcement.
Weakness: CWE-863
Which versions are affected by CVE-2026-79673?
3 open source packages ship an affected version, including github.com/lin-snow/ech0.
| Package | Affected | Fixed in |
|---|---|---|
github.com/lin-snow/ech0 Go | All versions | None |
github.com/lin-snow/ech0 Go | All versions | 4.4.3 |
github.com/lin-snow/ech0 Go | All versions | 4.4.3 |
How do I fix CVE-2026-79673?
Upgrade github.com/lin-snow/ech0 to 4.4.3 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-79673 being exploited?
There is no known exploitation of CVE-2026-79673 in the wild and no public exploit code.
Sources
Also known as GHSA-6h3p-88p7-m8gp, GHSA-hm2h-wwwh-g49x, GO-2026-5431.