CVE-2026-79673: Incorrect Authorization in lin-snow Ech0

CVE-2026-79673 describes an incorrect authorization vulnerability in lin-snow's Ech0 product prior to version 4.4.3. The PUT /user endpoint is improperly protected by the profile:read scope, which is intended to be read-only, yet it allows write operations including password changes. An attacker possessing an admin's profile:read access token can exploit this flaw to change the admin's password and subsequently log in to gain an unrestricted session token that bypasses all scope enforcement mechanisms.

An attacker with an admin-level profile:read token can escalate privileges by changing the admin password and obtaining an unrestricted session token. This effectively allows full administrative access, bypassing intended scope restrictions and potentially compromising the entire system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict issuance of profile:read tokens to trusted users only and monitor for suspicious use of the PUT /user endpoint.