VULNERABILITY INTELLIGENCE

CVE-2026-79673

CVSS score8.5 HIGH
EPSS probability0.43%
CISA KEVNot currently listed
Published2026-08-25
Last modified2026-08-31
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Description

Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An attacker with an admin's profile:read access token can change the admin's password and login to obtain an unrestricted session token that bypasses all scope enforcement.

Weakness classification

  • CWE-863: Incorrect Authorization

Primary references