Cloudanix VulnDB

GHSA-hm2h-wwwh-g49x

Medium · 6.5

Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session

CVSS

6.5

EPSS

—

Published

Apr 10, 2026

CISA due date

—

The record

The `PUT /user` endpoint is protected by `RequireScopes("profile:read")`, which is a read-only scope. However, the endpoint performs write operations including password changes. An attacker who obtains an admin's restricted `profile:read` access token can change the admin's password, then login to receive an unrestricted session token that bypasses all scope enforcement.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities