Description
Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment system settings by directly accessing the unprotected panel endpoints.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| lin-snow | Ech0 | < 4.4.3 | 4.4.3 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/lin-snow/ech0 | < 4.4.3 | 4.4.3 | GHSA-fwg7-53p4-g33c |
| Go | github.com/lin-snow/ech0 | all versions | — | GO-2026-5382 |
References
- GitHub Security Advisory (GHSA-fwg7-53p4-g33c) vendor-advisory
- VulnCheck Advisory: Ech0 before 4.4.3 Authentication Bypass via Comment Panel third-party-advisory