lin-snow Ech0 scope bypass in PUT /user endpoint

Executive brief

A vulnerability in the Ech0 platform allows an attacker with limited, read-only access to change an administrator's password. By exploiting this flaw, an attacker can take over an administrator account and gain full control over the system, including managing users, files, and settings. This effectively bypasses security restrictions intended to limit the power of specific access tokens.

Technical details

The vulnerability exists because the 'PUT /user' endpoint is incorrectly protected by the 'profile:read' scope, which is intended for read-only access. The underlying 'UpdateUser' service fails to verify if the provided access token has sufficient write permissions before updating sensitive fields like passwords. An attacker possessing a restricted 'profile:read' token can change an admin's password and subsequently log in to obtain a 'session' type token. Because the 'RequireScopes' middleware bypasses scope checks for session tokens, the attacker achieves unrestricted administrative access. This has been patched in version 4.4.3 by introducing a 'profile:write' scope.

Affected products

• lin-snow ech0 < 4.4.3

Timeline

• 2026-04-09: disclosed
• 2026-04-09: patched: Fixed in version 4.4.3
• 2026-04-10: advisory

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D