https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T21:52:22.925157+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-358622 EUVD-2026-358622 2026-10-05T21:52:22.973967+00:00 EUVD-2026-358622 https://cve.radiocsirt.org/vuln/fkie_cve-2026-79667 fkie_cve-2026-79667 2026-10-05T21:52:22.974005+00:00

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token (least-privilege) restrictions on several privileged admin routes. Multiple privileged endpoints (e.g., /api/inbox, /api/panel/comments, /api/backup/export) omit scope checks and authorize based only on the user's admin role, and the backup export handler discards token scope metadata entirely. An attacker holding a deliberately limited (low-scope) admin access token can reach broader privileged functionality than intended, including reading the inbox and exporting a full database backup ZIP archive. Fixed in 4.4.3.

 https://cve.radiocsirt.org/vuln/ghsa-vgpj-v99m-7h5j GHSA-vgpj-v99m-7h5j 2026-10-05T21:52:22.974042+00:00

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token (least-privilege) restrictions on several privileged admin routes. Multiple privileged endpoints (e.g., /api/inbox, /api/panel/comments, /api/backup/export) omit scope checks and authorize based only on the user's admin role, and the backup export handler discards token scope metadata entirely. An attacker holding a deliberately limited (low-scope) admin access token can reach broader privileged functionality than intended, including reading the inbox and exporting a full database backup ZIP archive. Fixed in 4.4.3.