CVE-2026-79665: Missing Authorization in lin-snow Ech0

CVE-2026-79665 describes an authorization bypass vulnerability in lin-snow's Ech0 product prior to version 4.5.1. The vulnerability arises because session tokens skip scope validation in the RequireScopes middleware, permitting non-admin authenticated users to access administrative endpoints. This bypass allows unauthorized reading of system logs, visitor statistics, user emails, and subscription to live WebSocket logs. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Attackers with valid non-admin session tokens can access sensitive administrative data and functionality, including system logs, visitor statistics, user emails, and live WebSocket logs. This compromises confidentiality and potentially integrity and availability of administrative resources.

No official patch or remediation level has been published yet. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to session tokens and monitor for unauthorized access attempts to administrative endpoints.