Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token (least-privilege) restrictions on several privileged admin routes. Multiple privileged endpoints (e.g., /api/inbox, /api/panel/comments, /api/backup/export) omit scope checks and authorize based only on the user's admin role, and the backup export handler discards token scope metadata entirely. An attacker holding a deliberately limited (low-scope) admin access token can reach broader privileged functionality than intended, including reading the inbox and exporting a full database backup ZIP archive. Fixed in 4.4.3.

Ech0 versions 4.3.4 and earlier contain a vulnerability where scoped access token (least-privilege) restrictions are not reliably enforced on several privileged admin API routes. Multiple endpoints such as /api/inbox, /api/panel/comments, and /api/backup/export omit scope checks and authorize requests based solely on the user's admin role. The backup export handler additionally discards token scope metadata entirely. An attacker with a deliberately limited low-scope admin access token can access broader privileged functionality than intended, including reading the inbox and exporting a full database backup as a ZIP archive. This represents a broken access control / authorization bypass issue. The vulnerability has been fixed in version 4.4.3. The issue is documented in the NVD, GitHub Security Advisories, and VulnCheck advisories.