medium6.5
CVE-2026-79673
Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes.
Impact
Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An attacker with an admin's profile:read access token can change the admin's password and login to obtain an unrestricted session token that bypasses all scope enforcement.
Affected products
| Product | Affected versions |
|---|---|
| Ech0 | before 4.4.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.