Is CVE-2026-79673 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79673 being exploited in the wild.

How severe is CVE-2026-79673?

Medium severity, with a CVSS score of 6.5, published 25 August 2026.

Which products and versions are affected?

github.com/lin-snow/ech0 (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=4.4.3; Lin-Snow Ech0 before 4.4.3.

Is there a fix for CVE-2026-79673?

Yes. github.com/lin-snow/ech0 (Go): upgrade to 4.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-79673 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-79673?

Check whether you run github.com/lin-snow/ech0 (Go) or Lin-Snow Ech0 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79673: Ech0 scope bypass in PUT /user endpoint via profile:read token

CVE-2026-79673 · Severity: medium · CVSS 6.5 · Published 2026-08-25

Ech0 is an API platform that uses access tokens with granular permission scopes to control what operations different integrations can perform. A critical flaw allows an attacker with a read-only "profile:read" token to bypass scope restrictions, change an admin's password, and escalate to a fully unrestricted admin session—completely circumventing the permission system and enabling account takeover.

Technologies: github.com/lin-snow/ech0 (Go), Lin-Snow Ech0. Vendors: Go, Lin-Snow.

Quick answers

Is CVE-2026-79673 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79673 being exploited in the wild.
How severe is CVE-2026-79673?: Medium severity, with a CVSS score of 6.5, published 25 August 2026.
Which products and versions are affected?: github.com/lin-snow/ech0 (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=4.4.3; Lin-Snow Ech0 before 4.4.3.
Is there a fix for CVE-2026-79673?: Yes. github.com/lin-snow/ech0 (Go): upgrade to 4.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79673 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-79673?: Check whether you run github.com/lin-snow/ech0 (Go) or Lin-Snow Ech0 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/lin-snow/ech0 (Go): upgrade to 4.4.3 or later
```
go get github.com/lin-snow/ech0@v4.4.3
```

Technical details

This is an authorization bypass (CWE-863) stemming from incorrect scope enforcement on the PUT /user endpoint. The endpoint is protected only by RequireScopes("profile:read"), a read-only scope, yet performs privileged write operations including password changes. The vulnerable code path: UpdateUser() accepts password changes without verifying write-level scope sufficiency; the scope middleware bypasses all checks for session tokens; after password change, POST /login issues an unrestricted session token that bypasses all subsequent scope enforcement. An attacker with an admin's profile:read access token (e.g., from compromised integration or log leak) can: (1) call PUT /user to change the admin's password, (2) login with new credentials to obtain a session token, (3) use the session token for unrestricted admin API access. Patch released in version 4.4.3 adds a profile:write scope and requires it for the PUT /user endpoint.

Affected products

lin-snow Ech0 before 4.4.3

Identifiers

CVE-2026-79673
GHSA-hm2h-wwwh-g49x
GO-2026-5431

Timeline

2026-04-09: disclosed
2026-08-25: advisory
2026-04-09: patched: Version 4.4.3 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.