Security Advisory

CVE-2026-79665

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-25 11:33:28

Last updated 2026-08-25 15:31:13

Assigner VulnCheck

CVSS score 8.8

State PUBLISHED

Description

Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emails, and subscribe to live WebSocket logs by sending authenticated session tokens to unprotected endpoints.

← Browse all CVEs View on cve.org ↗