CVE-2026-79667: Ech0 scoped admin token bypass

CISO Take

Ech0 (through 4.3.4) fails to enforce scope restrictions on limited-privilege admin tokens across several endpoints, including /api/inbox, /api/panel/comments, and — most critically — /api/backup/export, whose handler discards the token's scope metadata entirely and authorizes purely on the presence of the admin role. This means any workflow that issues deliberately narrow admin tokens, such as a support tool, third-party integration, or automation credential meant only to read comments, can silently be turned into a full-privilege credential capable of exfiltrating a complete database backup ZIP. There is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template available yet, but the CVSS 7.6 rating (AV:N/AC:L/PR:L/UI:N, high confidentiality impact) reflects that exploitation requires only network access and possession of any valid low-scope admin token — no user interaction and no special skill beyond knowing the endpoint paths. Patch to 4.4.3 immediately; until then, treat every issued low-scope admin token as equivalent to a full admin credential, audit and rotate any tokens handed to third parties or automation, and monitor for calls to /api/backup/export or /api/inbox from token holders who should not have broad access.

Sources: NVD GitHub Advisory vulncheck.com ATLAS

What is the risk?

High risk despite the absence of known exploitation or a public PoC. The vulnerability is a textbook broken access control flaw (CWE-285) with low attack complexity and no user interaction required — the only prerequisite is holding any valid admin-scoped token, however limited. Because scope enforcement is the security boundary the product advertises (least-privilege tokens), any integration, automation, or third party issued a narrow token is a latent path to full data exfiltration. The impact is asymmetric: a token meant to grant read-only comment access can be used to pull an entire database backup, making this a privilege-escalation-via-missing-authorization issue rather than a simple info leak. Absence from CISA KEV and lack of EPSS data indicate no confirmed mass exploitation yet, but the triviality of the bypass (calling a different endpoint with an already-valid token) means real-world abuse is plausible as soon as attackers or malicious insiders realize which tokens they hold.

How does the attack unfold?

Token Acquisition

Attacker obtains or already holds a deliberately limited (low-scope) admin access token, e.g. via a compromised integration, bot, or leaked CI credential.

AML.T0091.000

Scope-Check Bypass

Attacker calls privileged endpoints such as /api/inbox or /api/panel/comments, which authorize based on admin role alone and ignore the token's actual granted scope.

Privileged Endpoint Abuse

Attacker targets /api/backup/export, whose handler discards token scope metadata entirely, allowing the low-scope token to trigger a full database backup export.

Data Exfiltration

Attacker downloads the full database backup ZIP archive and/or reads inbox contents, achieving a confidentiality breach far beyond the token's intended permissions.

Token Acquisition

Attacker obtains or already holds a deliberately limited (low-scope) admin access token, e.g. via a compromised integration, bot, or leaked CI credential.

AML.T0091.000

Scope-Check Bypass

Attacker calls privileged endpoints such as /api/inbox or /api/panel/comments, which authorize based on admin role alone and ignore the token's actual granted scope.

Privileged Endpoint Abuse

Attacker targets /api/backup/export, whose handler discards token scope metadata entirely, allowing the low-scope token to trigger a full database backup export.

Data Exfiltration

Attacker downloads the full database backup ZIP archive and/or reads inbox contents, achieving a confidentiality breach far beyond the token's intended permissions.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Ech0	—	—	No patch

Do you use Ech0? You're affected.

How severe is it?

CVSS 3.1

7.6 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I Low

A Low

What should I do?

1 step

Patch Ech0 to 4.4.3 or later, where scope checks are correctly enforced on privileged routes. Until patched, treat all previously issued admin-scoped tokens (even ones intended to be narrow) as full-admin credentials — inventory every token in use by integrations, bots, and automation, and rotate/revoke any that are not strictly necessary. Restrict network access to /api/backup/export, /api/inbox, and /api/panel/comments at the reverse proxy or firewall layer to trusted admin source IPs where feasible. After upgrading, review Ech0's access logs for backup export or inbox reads from tokens/accounts that should only have had comment-moderation scope, as this is a strong indicator of prior abuse. Going forward, avoid issuing broad admin-role tokens for narrow integrations; verify post-patch that scope restrictions are actually enforced by testing a deliberately limited token against each privileged endpoint.

How is it classified?

Auth Bypass Data Leakage Privacy Violation Framework AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.3 - AI system access control / least privilege

NIST AI RMF

MANAGE-4.1 - Risk monitoring and access control effectiveness

Frequently Asked Questions

What is CVE-2026-79667?

Ech0 (through 4.3.4) fails to enforce scope restrictions on limited-privilege admin tokens across several endpoints, including /api/inbox, /api/panel/comments, and — most critically — /api/backup/export, whose handler discards the token's scope metadata entirely and authorizes purely on the presence of the admin role. This means any workflow that issues deliberately narrow admin tokens, such as a support tool, third-party integration, or automation credential meant only to read comments, can silently be turned into a full-privilege credential capable of exfiltrating a complete database backup ZIP. There is no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template available yet, but the CVSS 7.6 rating (AV:N/AC:L/PR:L/UI:N, high confidentiality impact) reflects that exploitation requires only network access and possession of any valid low-scope admin token — no user interaction and no special skill beyond knowing the endpoint paths. Patch to 4.4.3 immediately; until then, treat every issued low-scope admin token as equivalent to a full admin credential, audit and rotate any tokens handed to third parties or automation, and monitor for calls to /api/backup/export or /api/inbox from token holders who should not have broad access.

Is CVE-2026-79667 actively exploited?

No confirmed active exploitation of CVE-2026-79667 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-79667?

Patch Ech0 to 4.4.3 or later, where scope checks are correctly enforced on privileged routes. Until patched, treat all previously issued admin-scoped tokens (even ones intended to be narrow) as full-admin credentials — inventory every token in use by integrations, bots, and automation, and rotate/revoke any that are not strictly necessary. Restrict network access to /api/backup/export, /api/inbox, and /api/panel/comments at the reverse proxy or firewall layer to trusted admin source IPs where feasible. After upgrading, review Ech0's access logs for backup export or inbox reads from tokens/accounts that should only have had comment-moderation scope, as this is a strong indicator of prior abuse. Going forward, avoid issuing broad admin-role tokens for narrow integrations; verify post-patch that scope restrictions are actually enforced by testing a deliberately limited token against each privileged endpoint.

What systems are affected by CVE-2026-79667?

This vulnerability affects the following AI/ML architecture patterns: self-hosted AI web application admin panels, scoped API token / least-privilege access control systems, backup and data export pipelines.

What is the CVSS score for CVE-2026-79667?

CVE-2026-79667 has a CVSS v3.1 base score of 7.6 (HIGH).

What is the AI security impact?

Affected AI Architectures

self-hosted AI web application admin panelsscoped API token / least-privilege access control systemsbackup and data export pipelines

MITRE ATLAS Techniques

AML.T0091.000 Application Access Token

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

NIST AI RMF: MANAGE-4.1

What are the technical details?

Original Advisory

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token (least-privilege) restrictions on several privileged admin routes. Multiple privileged endpoints (e.g., /api/inbox, /api/panel/comments, /api/backup/export) omit scope checks and authorize based only on the user's admin role, and the backup export handler discards token scope metadata entirely. An attacker holding a deliberately limited (low-scope) admin access token can reach broader privileged functionality than intended, including reading the inbox and exporting a full database backup ZIP archive. Fixed in 4.4.3.

Exploitation Scenario

An organization integrates a third-party moderation bot with Ech0 and issues it a deliberately scoped admin token intended only to manage /api/panel/comments. An attacker who compromises that bot's environment, or intercepts the token via a misconfigured CI secret, discovers that the token is nominally 'low-scope' but that Ech0's backend does not actually check scope on other privileged routes. The attacker replays the same token against /api/backup/export, which ignores scope metadata entirely and authorizes based on admin role alone, and downloads a full database backup ZIP containing all application and user data. The attacker may also call /api/inbox to read private admin communications, escalating a narrowly-scoped integration credential into a full data breach without ever needing higher privileges or user interaction from a legitimate administrator.

Weaknesses (CWE)

CWE-285 Improper Authorization

CWE-285 — Improper Authorization: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that you perform access control checks related to your business logic. These checks may be different than the access control checks that you apply to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor.

Source: MITRE CWE corpus.