CVE-2026-79672: Ech0 scope bypass exposes comment

CISO Take

Ech0, an AI-adjacent ML UI tool with a built-in comment panel, fails to enforce scope-based authorization on nine admin endpoints, so an access token issued with minimal scopes can list, approve, reject, and delete comments and rewrite comment system settings. There's no evidence of active exploitation (not in CISA KEV, no SSVC decision, no public exploit or Nuclei template), EPSS data is unavailable, and the CVSS 5.5 (medium) score reflects that an attacker still needs a valid but limited-scope token (PR:H) rather than being fully unauthenticated. The real exposure is integrity and moderation-control loss (I:H) on a content surface, not confidentiality of core AI artifacts or model access — this is a classic broken-access-control bug (CWE-862) in an admin panel that happens to sit inside an ML UI product, not a novel AI attack technique. CISOs running Ech0 should upgrade to 4.4.3 immediately, audit any issued API/access tokens for scope creep, and review comment moderation logs for unexpected approve/reject/delete actions from low-privilege tokens as a compensating detection until patched.

Sources:NVDGitHub AdvisoryVulnCheck

What is the risk?

Medium severity (CVSS 5.5) driven by high privileges-required (an attacker needs an existing, even minimally-scoped, access token) but low attack complexity and no user interaction once that precondition is met. Impact is confined to comment moderation integrity (I:H) with a minor confidentiality leak (C:L, e.g. listing comments) and no availability impact. No KEV listing, no SSVC decision, no EPSS score, and no public exploit code or scanner template — exploitation likelihood is currently assessed as low, but the bug is trivial to exploit for anyone who already holds a low-scope token, since it only requires directly calling unprotected endpoints.

How does the attack unfold?

Initial Access

Attacker obtains a legitimate access token scoped to minimal, non-admin permissions (e.g. via a low-trust integration or partner API key).

Exploitation

Attacker directly calls one of the nine unprotected comment panel admin endpoints, bypassing the missing scope check (CWE-862).

Impact

Attacker lists, approves, rejects, or deletes comments and modifies comment system settings, gaining full moderation control despite holding only a minimal-scope token.

Initial Access

Attacker obtains a legitimate access token scoped to minimal, non-admin permissions (e.g. via a low-trust integration or partner API key).

Exploitation

Attacker directly calls one of the nine unprotected comment panel admin endpoints, bypassing the missing scope check (CWE-862).

Impact

Attacker lists, approves, rejects, or deletes comments and modifies comment system settings, gaining full moderation control despite holding only a minimal-scope token.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Ech0	—	—	No patch

Do you use Ech0? You're affected.

How severe is it?

CVSS 3.1

5.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 25% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRHigh

UINone

SUnchanged

CLow

IHigh

ANone

What should I do?

1 step

Upgrade Ech0 to version 4.4.3 or later, which enforces scope checks on the nine affected admin endpoints. Until patched, audit and, where possible, revoke or tightly restrict any access tokens issued to third-party integrations or lower-trust consumers, since any valid token can currently reach admin functionality regardless of declared scope. Monitor comment moderation activity (bulk approvals/rejections/deletions, settings changes) for actions performed by tokens that should only have limited scope, and restrict network exposure of the admin panel endpoints where feasible (e.g. reverse-proxy allowlisting) as a compensating control.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassFramework

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

NIST AI RMF

GOVERN 1.5-Access control and least-privilege enforcement for AI system components

Frequently Asked Questions

What is CVE-2026-79672?

Ech0, an AI-adjacent ML UI tool with a built-in comment panel, fails to enforce scope-based authorization on nine admin endpoints, so an access token issued with minimal scopes can list, approve, reject, and delete comments and rewrite comment system settings. There's no evidence of active exploitation (not in CISA KEV, no SSVC decision, no public exploit or Nuclei template), EPSS data is unavailable, and the CVSS 5.5 (medium) score reflects that an attacker still needs a valid but limited-scope token (PR:H) rather than being fully unauthenticated. The real exposure is integrity and moderation-control loss (I:H) on a content surface, not confidentiality of core AI artifacts or model access — this is a classic broken-access-control bug (CWE-862) in an admin panel that happens to sit inside an ML UI product, not a novel AI attack technique. CISOs running Ech0 should upgrade to 4.4.3 immediately, audit any issued API/access tokens for scope creep, and review comment moderation logs for unexpected approve/reject/delete actions from low-privilege tokens as a compensating detection until patched.

Is CVE-2026-79672 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-79672, increasing the risk of exploitation.

How to fix CVE-2026-79672?

Upgrade Ech0 to version 4.4.3 or later, which enforces scope checks on the nine affected admin endpoints. Until patched, audit and, where possible, revoke or tightly restrict any access tokens issued to third-party integrations or lower-trust consumers, since any valid token can currently reach admin functionality regardless of declared scope. Monitor comment moderation activity (bulk approvals/rejections/deletions, settings changes) for actions performed by tokens that should only have limited scope, and restrict network exposure of the admin panel endpoints where feasible (e.g. reverse-proxy allowlisting) as a compensating control.

What systems are affected by CVE-2026-79672?

This vulnerability affects the following AI/ML architecture patterns: ML/AI web UI admin panels, content moderation pipelines.

What is the CVSS score for CVE-2026-79672?

CVE-2026-79672 has a CVSS v3.1 base score of 5.5 (MEDIUM). The EPSS exploitation probability is 0.32%.

What is the AI security impact?

Affected AI Architectures

ML/AI web UI admin panelscontent moderation pipelines

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: GOVERN 1.5

What are the technical details?

Original Advisory

Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment system settings by directly accessing the unprotected panel endpoints.

Exploitation Scenario

An organization integrates a third-party plugin or partner service with Ech0 using an access token deliberately scoped to only read or post comments. Because Ech0 does not validate scope on nine admin endpoints, that same token can be pointed directly at the comment panel admin API to list all comments, approve or reject pending ones, delete comments en masse, and modify comment system settings — effectively granting the low-trust integration full moderator control it was never meant to have, with no additional authentication step or user interaction required.

Weaknesses (CWE)

CWE-862Missing AuthorizationPrimary CWE-862Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.