Executive brief
Ech0, a comment system and content management platform, fails to enforce access control restrictions on its comment moderation endpoints. An attacker with a legitimate but limited-permission access token (e.g., read-only access) can bypass these checks and perform unrestricted comment moderation operations—listing, approving, rejecting, and deleting comments—and modify comment system settings. This undermines the platform's ability to delegate restricted administrative tasks securely.
Technical details
The vulnerability is a missing authorization middleware (RequireScopes) on nine comment panel admin endpoints (/api/panel/comments/*) in the Go application. While other admin endpoint groups properly enforce scope-based authorization via the RequireScopes() middleware, the comment.go router registers all nine endpoints directly on AuthRouterGroup without any scope validation. The service layer's requireAdmin() check only validates the user's database role (IsAdmin/IsOwner), not the access token's scopes. An attacker with a valid JWT access token scoped to minimal permissions (e.g., echo:read only) can directly request these unprotected endpoints and perform full comment moderation operations. Session tokens bypass scope checks by design, but access tokens should not; the fix is to add RequireScopes() middleware to each comment panel endpoint with appropriate scopes (e.g., comment:moderate, comment:read, comment:write).
Affected products
- lin-snow Ech0 before 4.4.3
Timeline
- 2026-04-09: disclosed
- 2026-04-09: patched: Version 4.4.3 includes the fix
- 2026-08-25: advisory