VULNERABILITY INTELLIGENCE
CVE-2026-79672
CVSS score5.5 MEDIUM
EPSS probability0.32%
CISA KEVNot currently listed
Published2026-08-25
Last modified2026-08-31
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
Description
Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment system settings by directly accessing the unprotected panel endpoints.
Weakness classification
- disclosure@vulncheck.com: CWE-862