Root cause
Authentication & access control introduced
feat(authz): enforce route-level scope checks for access tokens
AI-written code bound the write-capable PUT /user endpoint to the read-only profile:read scope, letting an attacker with that token change an admin’s password and gain an unrestricted session.
How AI contributed: Direct introductionPublished Apr 10, 2026 in 
lin-snow/Ech0All 3 findings in this repository
Show full advisory descriptionHide advisory description
Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An attacker with an admin's profile:read access token can change the admin's password and login to obtain an unrestricted session token that bypasses all scope enforcement.
What actually happenedHide details
A scoped access token carrying only profile:read is accepted by PUT /user because that mutating route is guarded by RequireScopes(ScopeProfileRead). UpdateUser uses the token viewer's administrator identity and permits a supplied password to replace that administrator's password. The attacker can then log in with the replacement password; login issues a session JWT, and RequireScopes deliberately bypasses scope checks for session tokens, yielding unrestricted administrator access.
Fix
Security fix
refactor: remove inbox-related functionality and references
Fix by L1nSn0w · no AI marker found
Case facts
- CVE ID
- CVE-2026-79673
- GHSA ID
- GHSA-HM2H-WWWH-G49X
- Published
- Apr 10, 2026
- Severity
- HIGH
- Language
- Go
- AI tool
Cursor- AI role
- Direct introduction
- Vulnerable release
- <= 4.2.1
- Fixed release
- 4.4.3
AI-assisted change
AI-assisted changeinternal/router/user.gosource lin-snow/Ech0@b47fa1c75d+53−10
@@ -3,6 +3,7 @@ package router import ( "github.com/lin-snow/ech0/internal/handler" "github.com/lin-snow/ech0/internal/middleware"Show 19 hidden lines
+ authModel "github.com/lin-snow/ech0/internal/model/auth" ) // setupUserRoutes 设置用户路由@@ -26,22 +27,64 @@ func setupUserRoutes(appRouterGroup *AppRouterGroup, h *handler.Bundle) { ) // Auth- appRouterGroup.AuthRouterGroup.GET("/allusers", h.UserHandler.GetAllUsers())- appRouterGroup.AuthRouterGroup.GET("/user", h.UserHandler.GetUserInfo())- appRouterGroup.AuthRouterGroup.PUT("/user", h.UserHandler.UpdateUser())- appRouterGroup.AuthRouterGroup.DELETE("/user/:id", h.UserHandler.DeleteUser())- appRouterGroup.AuthRouterGroup.PUT("/user/admin/:id", h.UserHandler.UpdateUserAdmin())- appRouterGroup.AuthRouterGroup.POST("/oauth/:provider/bind", h.UserHandler.OAuthBind())- appRouterGroup.AuthRouterGroup.GET("/oauth/info", h.UserHandler.GetOAuthInfo())+ appRouterGroup.AuthRouterGroup.GET(+ "/allusers",+ middleware.RequireScopes(authModel.ScopeAdminUser),+ h.UserHandler.GetAllUsers(),+ )+ appRouterGroup.AuthRouterGroup.GET(+ "/user",+ middleware.RequireScopes(authModel.ScopeProfileRead),+ h.UserHandler.GetUserInfo(),+ )+ appRouterGroup.AuthRouterGroup.PUT(+ "/user",+ middleware.RequireScopes(authModel.ScopeProfileRead),+ h.UserHandler.UpdateUser(),+ )+ appRouterGroup.AuthRouterGroup.DELETE(Show 8 hidden lines
+ "/user/:id",+ middleware.RequireScopes(authModel.ScopeAdminUser),+ h.UserHandler.DeleteUser(),+ )+ appRouterGroup.AuthRouterGroup.PUT(+ "/user/admin/:id",+ middleware.RequireScopes(authModel.ScopeAdminUser),+ h.UserHandler.UpdateUserAdmin(),+ )+ appRouterGroup.AuthRouterGroup.POST(+ "/oauth/:provider/bind",+ middleware.RequireScopes(authModel.ScopeProfileRead),+ h.UserHandler.OAuthBind(),+ )+ appRouterGroup.AuthRouterGroup.GET(+ "/oauth/info",+ middleware.RequireScopes(authModel.ScopeProfileRead),+ h.UserHandler.GetOAuthInfo(),+ ) appRouterGroup.AuthRouterGroup.POST( "/passkey/register/begin",+ middleware.RequireScopes(authModel.ScopeProfileRead), h.UserHandler.PasskeyRegisterBeginV2(), ) appRouterGroup.AuthRouterGroup.POST( "/passkey/register/finish",+ middleware.RequireScopes(authModel.ScopeProfileRead), h.UserHandler.PasskeyRegisterFinishV2(), )- appRouterGroup.AuthRouterGroup.GET("/passkeys", h.UserHandler.ListPasskeys())Show 1 hidden lines
- appRouterGroup.AuthRouterGroup.DELETE("/passkeys/:id", h.UserHandler.DeletePasskey())- appRouterGroup.AuthRouterGroup.PUT("/passkeys/:id", h.UserHandler.UpdatePasskeyDeviceName())+ appRouterGroup.AuthRouterGroup.GET(+ "/passkeys",+ middleware.RequireScopes(authModel.ScopeProfileRead),+ h.UserHandler.ListPasskeys(),+ )+ appRouterGroup.AuthRouterGroup.DELETE(+ "/passkeys/:id",+ middleware.RequireScopes(authModel.ScopeProfileRead),+ h.UserHandler.DeletePasskey(),+ )+ appRouterGroup.AuthRouterGroup.PUT(+ "/passkeys/:id",+ middleware.RequireScopes(authModel.ScopeProfileRead),+ h.UserHandler.UpdatePasskeyDeviceName(),+ ) }PUT /user and the other account routes were originally registered and guarded with RequireScopes(ScopeProfileRead). Because profile:read is a read-only scope but the handler performs writes including password changes, a stolen profile:read token could take over the administrator account.
Security fix
Fixinternal/model/auth/scope.gosource lin-snow/Ech0@057e8b0b71+2−0
@@ -16,6 +16,7 @@ const ( ScopeConnectRead = "connect:read" ScopeConnectWrite = "connect:write" ScopeProfileRead = "profile:read"+ ScopeProfileWrite = "profile:write" ScopeAdminSettings = "admin:settings" ScopeAdminUser = "admin:user" ScopeAdminToken = "admin:token"Show 1 hidden lines
@@ -36,6 +37,7 @@ var validScopes = map[string]struct{}{ ScopeConnectRead: {}, ScopeConnectWrite: {}, ScopeProfileRead: {},+ ScopeProfileWrite: {}, ScopeAdminSettings: {}, ScopeAdminUser: {}, ScopeAdminToken: {},A new ScopeProfileWrite ('profile:write') constant is introduced into the scope registry so write endpoints can require a distinct, write-only capability instead of reusing a read scope.
Fixinternal/middleware/scope_test.gosource lin-snow/Ech0@057e8b0b71+59−0
@@ -74,6 +74,65 @@ func TestRequireScopes_ReturnsAudienceForbiddenCode(t *testing.T) { } } Show 13 hidden lines
+func TestRequireScopes_ProfileReadCannotAccessProfileWrite(t *testing.T) {+ gin.SetMode(gin.TestMode)+ r := gin.New()+ r.Use(func(c *gin.Context) {+ viewer.AttachToRequest(+ &c.Request,+ viewer.NewUserViewerWithToken(+ "user-1",+ authModel.TokenTypeAccess,+ []string{authModel.ScopeProfileRead},+ []string{authModel.AudiencePublic},+ "jti-profile-write-test",+ ),+ )+ c.Next()+ })+ r.PUT("/user", RequireScopes(authModel.ScopeProfileWrite), func(c *gin.Context) {+ c.Status(http.StatusOK)+ })+Show 17 hidden lines
+ req := httptest.NewRequest(http.MethodPut, "/user", nil)+ rec := httptest.NewRecorder()+ r.ServeHTTP(rec, req)+ if rec.Code != http.StatusForbidden {+ t.Fatalf("expected status %d, got %d", http.StatusForbidden, rec.Code)+ }+ if got := parseErrorCode(rec.Body.Bytes()); got != commonModel.ErrCodeScopeForbidden {+ t.Fatalf("expected error code %s, got %s", commonModel.ErrCodeScopeForbidden, got)+ }+}++func TestRequireScopes_ProfileWriteAllowsAccess(t *testing.T) {+ gin.SetMode(gin.TestMode)+ r := gin.New()+ r.Use(func(c *gin.Context) {+ viewer.AttachToRequest(+ &c.Request,+ viewer.NewUserViewerWithToken(+ "user-1",+ authModel.TokenTypeAccess,+ []string{authModel.ScopeProfileWrite},+ []string{authModel.AudiencePublic},+ "jti-profile-write-ok",+ ),+ )+ c.Next()+ })+ r.PUT("/user", RequireScopes(authModel.ScopeProfileWrite), func(c *gin.Context) {+ c.Status(http.StatusOK)+ })+Show 11 hidden lines
+ req := httptest.NewRequest(http.MethodPut, "/user", nil)+ rec := httptest.NewRecorder()+ r.ServeHTTP(rec, req)+ if rec.Code != http.StatusOK {+ t.Fatalf("expected status %d, got %d", http.StatusOK, rec.Code)+ }+}+ func parseErrorCode(body []byte) string { var payload struct { ErrorCode string `json:"error_code"`The middleware test asserts that a token holding only profile:read is refused on routes that demand profile:write, pinning down the separation between read and write scopes at the handler boundary.
Fixinternal/router/user.gosource lin-snow/Ech0@057e8b0b71+6−6
@@ -39,7 +39,7 @@ func setupUserRoutes(appRouterGroup *AppRouterGroup, h *handler.Bundle) { ) appRouterGroup.AuthRouterGroup.PUT( "/user",- middleware.RequireScopes(authModel.ScopeProfileRead),+ middleware.RequireScopes(authModel.ScopeProfileWrite), h.UserHandler.UpdateUser(), ) appRouterGroup.AuthRouterGroup.DELETE(Show 2 hidden lines
@@ -54,7 +54,7 @@ func setupUserRoutes(appRouterGroup *AppRouterGroup, h *handler.Bundle) { ) appRouterGroup.AuthRouterGroup.POST( "/oauth/:provider/bind",- middleware.RequireScopes(authModel.ScopeProfileRead),+ middleware.RequireScopes(authModel.ScopeProfileWrite), h.UserHandler.OAuthBind(), ) appRouterGroup.AuthRouterGroup.GET(Show 2 hidden lines
@@ -64,12 +64,12 @@ func setupUserRoutes(appRouterGroup *AppRouterGroup, h *handler.Bundle) { ) appRouterGroup.AuthRouterGroup.POST( "/passkey/register/begin",- middleware.RequireScopes(authModel.ScopeProfileRead),+ middleware.RequireScopes(authModel.ScopeProfileWrite), h.UserHandler.PasskeyRegisterBeginV2(), ) appRouterGroup.AuthRouterGroup.POST( "/passkey/register/finish",- middleware.RequireScopes(authModel.ScopeProfileRead),+ middleware.RequireScopes(authModel.ScopeProfileWrite), h.UserHandler.PasskeyRegisterFinishV2(), ) appRouterGroup.AuthRouterGroup.GET(Show 2 hidden lines
@@ -79,12 +79,12 @@ func setupUserRoutes(appRouterGroup *AppRouterGroup, h *handler.Bundle) { ) appRouterGroup.AuthRouterGroup.DELETE( "/passkeys/:id",- middleware.RequireScopes(authModel.ScopeProfileRead),+ middleware.RequireScopes(authModel.ScopeProfileWrite), h.UserHandler.DeletePasskey(), ) appRouterGroup.AuthRouterGroup.PUT( "/passkeys/:id",- middleware.RequireScopes(authModel.ScopeProfileRead),+ middleware.RequireScopes(authModel.ScopeProfileWrite), h.UserHandler.UpdatePasskeyDeviceName(), ) }Every mutating profile route now swaps RequireScopes(ScopeProfileRead) for RequireScopes(ScopeProfileWrite). A read-scoped token can no longer change the password, and session JWTs remain the only way to reach these endpoints.
Patch fingerprints
AI-assisted change a6b0caf576157ad0b855229585984f44422f0b63ea68e5183d0cb204cfd87ade · Fix 8a3746d6ebf9d82ed213b8b49a969062df885759399b6d56bba6d04096d3cb9c