Root cause
Authentication & access control
The AI-assisted change below is where the vulnerable behavior appears.
AI-assisted scope hardening on the user-list route left ordinary sessions exempt from capability checks and relied on an administrator check that the existing service did not perform. The exposure predated that hardening. Other dashboard routes and the separate WebSocket log path also lack required role authorization, but those independent omissions are not attributed to this change. Version 4.5.1 adds an administrator check for user listing only. Dashboard and log-stream exposure remains in the inspected source revision; no complete advisory repair or binary equivalence is established.
How AI contributed: Flawed AI-written codePublished Aug 25, 2026 in 
lin-snow/ech0
Provisional finding. Full causal and release verification remains incomplete.
What actually happenedHide details
AI-assisted scope hardening on the user-list route left ordinary sessions exempt from capability checks and relied on an administrator check that the existing service did not perform. The exposure predated that hardening. Other dashboard routes and the separate WebSocket log path also lack required role authorization, but those independent omissions are not attributed to this change.
Fix status
No public fix identified
No minimum fix commit has been established for this finding.
Fix status unresolved
Case facts
- CVE ID
- CVE-2026-79665
- GHSA ID
- GHSA-Q8HH-M6V5-4F3X
- Published
- Aug 25, 2026
- Severity
- Not scored
- Language
- Go
- AI tool
Cursor- AI role
- Flawed AI-written code
- Vulnerable release
- v4.5.0; dashboard and log-stream remainder in v4.5.1 and inspected main
AI-assisted change
AI-assisted changeinternal/middleware/scope.gosource lin-snow/ech0@b47fa1c75d+10−0
@@ -0,0 +13,10 @@++func RequireScopes(scopes ...string) gin.HandlerFunc {+ return func(ctx *gin.Context) {+ v := viewer.MustFromContext(ctx.Request.Context())+ if v.TokenType() == authModel.TokenTypeSession {+ ctx.Next()+ return+ }Show 2 hidden lines
+ if v.TokenType() != authModel.TokenTypeAccess {+ ctx.JSON(Ordinary session tokens leave the scope middleware before capability checks; the affected user-list service still needed a role check.
AI-assisted changeinternal/router/user.gosource lin-snow/ech0@b47fa1c75d+5−7
@@ -26,10 +27,8 @@ ) // Auth- appRouterGroup.AuthRouterGroup.GET("/allusers", h.UserHandler.GetAllUsers())- appRouterGroup.AuthRouterGroup.GET("/user", h.UserHandler.GetUserInfo())- appRouterGroup.AuthRouterGroup.PUT("/user", h.UserHandler.UpdateUser())- appRouterGroup.AuthRouterGroup.DELETE("/user/:id", h.UserHandler.DeleteUser())Show 8 hidden lines
- appRouterGroup.AuthRouterGroup.PUT("/user/admin/:id", h.UserHandler.UpdateUserAdmin())- appRouterGroup.AuthRouterGroup.POST("/oauth/:provider/bind", h.UserHandler.OAuthBind())- appRouterGroup.AuthRouterGroup.GET("/oauth/info", h.UserHandler.GetOAuthInfo())+ appRouterGroup.AuthRouterGroup.GET(+ "/allusers",+ middleware.RequireScopes(authModel.ScopeAdminUser),+ h.UserHandler.GetAllUsers(),+ )The existing authenticated user-list route gains an administrative capability guard, while session-token authorization still depends on the service.
Curated comparison
Comparisoninternal/service/user/user.gosource lin-snow/ech0@b47fa1c75d+12−2
@@ -402,8 +402,18 @@ // 返回: // - []model.User: 用户列表（不包含密码信息） // - error: 获取过程中的错误信息-func (userService *UserService) GetAllUsers() ([]model.User, error) {- allures, err := userService.userRepository.GetAllUsers(context.Background())+func (userService *UserService) GetAllUsers(ctx context.Context) ([]model.User, error) {+ // Only Admin can get all usersShow 13 hidden lines
+ userid := viewer.MustFromContext(ctx).UserID()+ caller, err := userService.userRepository.GetUserByID(ctx, userid)+ if err != nil {+ return nil, err+ }+ if !caller.IsAdmin {+ return nil, errors.New(commonModel.NO_PERMISSION_DENIED)+ }++ allures, err := userService.userRepository.GetAllUsers(ctx) if err != nil { return nil, err }The later user-list change checks the persisted administrator role. This closes only the user-list slice, not the dashboard or log-stream remainder.