Is CVE-2026-79672 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79672 being exploited in the wild.

How severe is CVE-2026-79672?

Medium severity, with a CVSS score of 5.5, published 25 August 2026.

Which products and versions are affected?

github.com/lin-snow/ech0 (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=4.4.3; Lin-Snow Ech0 before 4.4.3.

Is there a fix for CVE-2026-79672?

Yes. github.com/lin-snow/ech0 (Go): upgrade to 4.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-79672 attacked?

It is attacked over the network.

Am I affected by CVE-2026-79672?

Check whether you run github.com/lin-snow/ech0 (Go) or Lin-Snow Ech0 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79672: Ech0 authorization bypass in comment panel endpoints

CVE-2026-79672 · Severity: medium · CVSS 5.5 · Published 2026-08-25

Ech0, a comment system and content management platform, fails to enforce access control restrictions on its comment moderation endpoints. An attacker with a legitimate but limited-permission access token (e.g., read-only access) can bypass these checks and perform unrestricted comment moderation operations—listing, approving, rejecting, and deleting comments—and modify comment system settings. This undermines the platform's ability to delegate restricted administrative tasks securely.

Technologies: github.com/lin-snow/ech0 (Go), Lin-Snow Ech0. Vendors: Go, Lin-Snow.

Quick answers

Is CVE-2026-79672 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79672 being exploited in the wild.
How severe is CVE-2026-79672?: Medium severity, with a CVSS score of 5.5, published 25 August 2026.
Which products and versions are affected?: github.com/lin-snow/ech0 (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=4.4.3; Lin-Snow Ech0 before 4.4.3.
Is there a fix for CVE-2026-79672?: Yes. github.com/lin-snow/ech0 (Go): upgrade to 4.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79672 attacked?: It is attacked over the network.
Am I affected by CVE-2026-79672?: Check whether you run github.com/lin-snow/ech0 (Go) or Lin-Snow Ech0 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/lin-snow/ech0 (Go): upgrade to 4.4.3 or later
```
go get github.com/lin-snow/ech0@v4.4.3
```

Technical details

The vulnerability is a missing authorization middleware (RequireScopes) on nine comment panel admin endpoints (/api/panel/comments/*) in the Go application. While other admin endpoint groups properly enforce scope-based authorization via the RequireScopes() middleware, the comment.go router registers all nine endpoints directly on AuthRouterGroup without any scope validation. The service layer's requireAdmin() check only validates the user's database role (IsAdmin/IsOwner), not the access token's scopes. An attacker with a valid JWT access token scoped to minimal permissions (e.g., echo:read only) can directly request these unprotected endpoints and perform full comment moderation operations. Session tokens bypass scope checks by design, but access tokens should not; the fix is to add RequireScopes() middleware to each comment panel endpoint with appropriate scopes (e.g., comment:moderate, comment:read, comment:write).

Affected products

lin-snow Ech0 before 4.4.3

Identifiers

CVE-2026-79672
GHSA-fwg7-53p4-g33c
GO-2026-5382

Timeline

2026-04-09: disclosed
2026-04-09: patched: Version 4.4.3 includes the fix
2026-08-25: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.