Ech0 versions prior to 4.4.3 protect the /user endpoint by requiring the profile:read scope, which is intended to allow only read access. However, the endpoint incorrectly authorizes write operations, such as password changes, when this read‑only scope is presented. An attacker who can acquire an admin’s profile:read token can therefore change that admin’s password and use the new credential to obtain an unrestricted session token, effectively bypassing all scope enforcement. This flaw is a manifestation of CWE‑863, an improper authorization problem that elevates an attacker’s privileges within the application.

The vulnerability affects the Ech0 application provided by lin‑snow. All releases earlier than version 4.4.3 are impacted, as noted in the advisory. The affected endpoint is PUT /user, which exists in the framework and is exposed to authenticated users.

The CVSS score of 8.5 indicates a high severity, and although the EPSS score is not available, the CVE’s impact suggests a realistic exploitation potential. An attacker only needs a valid profile:read token with admin access, which can be obtained through phishing, credential reuse, or other means. Once exploited, the attacker receives an unrestricted session token that grants full control over the application, enabling further lateral movement or data exfiltration. The vulnerability is listed as not in the CISA KEV catalog, but its existence in a common API endpoint makes it a high‑risk vector for remote exploitation.