Is CVE-2026-79665 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79665 being exploited in the wild.

How severe is CVE-2026-79665?

High severity, with a CVSS score of 8.8, published 25 August 2026.

Is there a fix for CVE-2026-79665?

A patch was published on 2026-04-13: Fix released in version 4.5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-79665 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-79665?

Check whether you run Lin-Snow Ech0 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79665: Ech0 authorization bypass in RequireScopes middleware

CVE-2026-79665 · Severity: high · CVSS 8.8 · Published 2026-08-25

Ech0 is a dashboard and analytics platform. A flaw in its authorization middleware allows logged-in regular users to bypass authentication checks and access admin-only features. This enables attackers to read system logs (containing failed login attempts and internal system paths), access all user emails and credentials, and monitor live system activity through WebSocket connections that should be restricted to administrators.

Technologies: Lin-Snow Ech0. Vendors: Lin-Snow.

Quick answers

Is CVE-2026-79665 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79665 being exploited in the wild.
How severe is CVE-2026-79665?: High severity, with a CVSS score of 8.8, published 25 August 2026.
Which products and versions are affected?: Lin-Snow Ech0 before 4.5.1.
Is there a fix for CVE-2026-79665?: A patch was published on 2026-04-13: Fix released in version 4.5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79665 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-79665?: Check whether you run Lin-Snow Ech0 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authorization check (CWE-862) in the RequireScopes middleware. Session tokens bypass scope validation by design (intended for interactive UI use), but the admin handlers never implement their own IsAdmin checks. Three independent gaps combine to enable the bypass: (1) RequireScopes returns early for session tokens without validating scope, (2) affected handlers (GetSystemLogs, GetVisitorStats, GetAllUsers, WSSubscribeSystemLogs) lack IsAdmin checks, and (3) the /ws WebSocket route group has no middleware at all. An authenticated user can send their session token to unprotected admin endpoints to read system logs, visitor statistics, user emails, and subscribe to live WebSocket logs. The patch is available in version 4.5.1; versions before 4.5.0 require upgrade.

Affected products

lin-snow Ech0 before 4.5.1

Timeline

2026-04-13: disclosed: GitHub Security Advisory GHSA-hmmq-qh6g-6wgh published
2026-08-25: other: CVE-2026-79665 assigned and published to NVD
2026-04-13: patched: Fix released in version 4.5.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.