CVE-2026-79672 Ech0 before 4.4.3 Authentication Bypass via Comment Panel

Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment...

CVE-2026-79672

Ech0 before version 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints. Attackers holding a limited-scope access token can bypass intended restrictions to perform full comment moderation operations, including listing, approving, rejecting, and deleting comments...

GO-2026-5382 Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass in github.com/lin-snow/ech0

Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

GHSA-FWG7-53P4-G33C Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass

Summary All 9 comment panel admin endpoints /api/panel/comments/ are missing RequireScopes middleware, while every other admin endpoint in the application enforces scope-based authorization on access tokens. An admin-issued access token scoped to minimal permissions e.g., echo:read only can perfo...