Executive brief
Ech0, a self-hosted information management platform, contains a flaw in how it handles administrative access tokens. An attacker with a restricted, low-privilege API token can bypass security boundaries to perform high-privilege actions, such as downloading full system backups or accessing private inboxes. This could lead to the total exposure of sensitive database contents and system logs.
Technical details
A vulnerability in Ech0's authorization model allows scoped access tokens to bypass least-privilege restrictions. While the system uses a 'RequireScopes' middleware, several privileged routes (including /api/inbox, /api/migration, and /api/backup/export) fail to implement it, relying instead on a simple 'IsAdmin' check at the service layer. Furthermore, the backup export handler manually reparses JWT tokens and reconstructs the user context without preserving scope metadata, effectively stripping all restrictions from the token. An attacker with a valid but restricted admin token can exploit these omissions to exfiltrate full system backups or access restricted administrative data. The issue is addressed in version 4.3.5 (or 4.4.3 depending on the release branch).
Affected products
- lin-snow Ech0 <= 4.3.4
Timeline
- 2026-04-09: advisory: GitHub Advisory published
- 2026-04-10: disclosed
- 2026-06-02: other: Advisory updated