Executive brief
Ech0 is a dashboard and analytics platform. A flaw in its authorization middleware allows logged-in regular users to bypass authentication checks and access admin-only features. This enables attackers to read system logs (containing failed login attempts and internal system paths), access all user emails and credentials, and monitor live system activity through WebSocket connections that should be restricted to administrators.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the RequireScopes middleware. Session tokens bypass scope validation by design (intended for interactive UI use), but the admin handlers never implement their own IsAdmin checks. Three independent gaps combine to enable the bypass: (1) RequireScopes returns early for session tokens without validating scope, (2) affected handlers (GetSystemLogs, GetVisitorStats, GetAllUsers, WSSubscribeSystemLogs) lack IsAdmin checks, and (3) the /ws WebSocket route group has no middleware at all. An authenticated user can send their session token to unprotected admin endpoints to read system logs, visitor statistics, user emails, and subscribe to live WebSocket logs. The patch is available in version 4.5.1; versions before 4.5.0 require upgrade.
Affected products
- lin-snow Ech0 before 4.5.1
Timeline
- 2026-04-13: disclosed: GitHub Security Advisory GHSA-hmmq-qh6g-6wgh published
- 2026-08-25: other: CVE-2026-79665 assigned and published to NVD
- 2026-04-13: patched: Fix released in version 4.5.1