CVE-2026-79667 Overview
CVE-2026-79667 is a broken access control vulnerability in Ech0, a lightweight self-hosted publishing platform. Versions 4.3.4 and earlier fail to enforce scoped access token restrictions on several privileged administrative routes. Endpoints such as /api/inbox, /api/panel/comments, and /api/backup/export authorize requests based only on the caller's admin role, ignoring the token's declared scope. An attacker holding a deliberately limited admin token can reach broader functionality than intended, including reading the inbox and exporting a complete database backup archive. The issue is tracked as CWE-285: Improper Authorization and is fixed in Ech0 4.4.3.
Critical Impact
A low-scope admin token can be used to export the full application database as a ZIP archive, exposing all stored data.
Affected Products
- Ech0 versions 4.3.4 and earlier
- Ech0 self-hosted deployments using scoped admin access tokens
- Ech0 backup and inbox management components
Discovery Timeline
- 2026-08-25 - CVE-2026-79667 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-79667
Vulnerability Analysis
Ech0 supports scoped access tokens intended to grant admins narrower permissions than their full role. The scope enforcement layer is applied inconsistently across the API surface. Several privileged handlers check only whether the authenticated principal has the admin role, then proceed with the requested action. The token scope metadata that should further restrict what the token can do is not consulted.
The backup export handler at /api/backup/export is the highest-impact case. That endpoint discards token scope metadata entirely before authorizing the operation. Any valid admin token, regardless of its declared scope, can trigger a full database export as a ZIP archive. The /api/inbox and /api/panel/comments routes behave similarly and expose inbox contents and moderation data.
Root Cause
The root cause is missing authorization checks against the token's scope claims [CWE-285]. Authorization logic collapses to a single role check rather than a two-step evaluation of role plus scope. Where scope metadata is intended to reduce privileges below the admin baseline, the handlers never read it. In the backup path, the scope is dropped from the request context before the authorization decision is made.
Attack Vector
An attacker who has obtained a low-scope admin token, whether through delegation, credential leakage, or a compromised integration, can issue authenticated HTTP requests directly to the affected endpoints. Because network access to the admin API and a valid low-privilege token are sufficient, no user interaction or additional escalation is required. The attacker can request /api/backup/export and receive the full backup ZIP, or query /api/inbox and /api/panel/comments to retrieve data the token was never intended to reach.
Refer to the GitHub Security Advisory GHSA-4h9q-p5j4-xvvh and the VulnCheck Advisory on Ech0 for further technical detail.
Detection Methods for CVE-2026-79667
Indicators of Compromise
- Unexpected GET or POST requests to /api/backup/export from admin tokens that should not have backup scope.
- Access log entries for /api/inbox or /api/panel/comments originating from service tokens or integration accounts.
- Outbound transfers of large ZIP archives from the Ech0 host shortly after admin API activity.
Detection Strategies
- Correlate admin API access logs with the scope claims of the presenting token and alert on mismatches.
- Baseline normal callers of /api/backup/export and flag any new principal invoking the endpoint.
- Monitor for repeated requests to privileged admin routes from tokens created for narrow automation use cases.
Monitoring Recommendations
- Forward Ech0 application logs and reverse-proxy access logs to a centralized analytics platform for retention and query.
- Track byte-size distributions of responses from /api/backup/export to identify anomalous full-database exports.
- Alert on creation of new admin tokens and on any first-time use of an existing token against the affected endpoints.
How to Mitigate CVE-2026-79667
Immediate Actions Required
- Upgrade Ech0 to version 4.4.3 or later, which enforces scope on the affected admin routes.
- Rotate all admin access tokens and invalidate any tokens that may have been exposed to untrusted integrations.
- Review recent access logs for /api/backup/export, /api/inbox, and /api/panel/comments for unexpected callers.
Patch Information
The maintainer released Ech0 4.4.3 to correct the authorization logic. Post-patch, privileged handlers evaluate both the admin role and the token's scope, and the backup export handler preserves scope metadata through the authorization decision. See the GitHub Security Advisory GHSA-4h9q-p5j4-xvvh for release details.
Workarounds
- Restrict network access to the Ech0 admin API using a reverse proxy or firewall rules that permit only trusted management hosts.
- Avoid issuing low-scope admin tokens until the upgrade is applied; treat every admin token as fully privileged in the interim.
- Disable or gate the /api/backup/export route at the reverse proxy layer if backups can be run out-of-band.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
