CVE-2026-79672: Ech0 before 4.4.3 Authentication Bypass via Comment Panel

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-25 · updated 2026-08-31
Weakness: CWE-862

Description

Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment system settings by directly accessing the unprotected panel endpoints.

Affected products

lin-snow Ech0: before 4.4.3 — fixed in 4.4.3

How to fix

Upgrade to a fixed version: lin-snow Ech0 4.4.3. Check the vendor advisory for mitigations.

References

https://github.com/lin-snow/Ech0/security/advisories/GHSA-fwg7-53p4-g33c
https://www.vulncheck.com/advisories/ech0-before-authentication-bypass-via-comment-panel

Get alerted when CVE-2026-79672 or the next vulnerability affects your stack