GHSA-4h9q-p5j4-xvvh

## Summary Ech0 scoped access tokens do not reliably enforce least privilege: multiple privileged admin routes omit scope checks, and the backup export handler strips token scope metadata entirely, allowing a low-scope admin access token to reach broader admin functionality than intended. ## Impact An attacker who obtains a deliberately limited access token for an admin account can use that token to access privileged functionality outside its assigned scope. Confirmed impact includes access to `/api/inbox` with a token scoped only for `echo:read` and successful backup export via `/api/backup/export?token=...`, which returns a full ZIP archive. In practice, this turns a narrowly delegated API token into a broader privileged access and data exfiltration primitive. ## Details The issue is caused by a split authorization model: - `JWTAuthMiddleware()` authenticates the token and stores scope metadata in the viewer context - `RequireScopes(...)` enforces least privilege, but only when a route explicitly adds it - several privileged routes omit `RequireScopes(...)` - multiple service methods then authorize using only `user.IsAdmin` `internal/middleware/scope.go` shows that scope enforcement is opt-in: ```go func RequireScopes(scopes ...string) gin.HandlerFunc { return func(ctx *gin.Context) { v := viewer.MustFromContext(ctx.Request.Context()) if v.TokenType() == authModel.TokenTypeSession { ctx.Next() return } if v.TokenType() != authModel.TokenTypeAccess { ... } if !containsValidAudience(v.Audience()) { ... } if !containsAllScopes(v.Scopes(), scopes) { ... } ctx.Next() } } ``` Representative privileged routes omit `RequireScopes(...)`, for example `internal/router/inbox.go`: ```go func setupInboxRoutes(appRouterGroup *AppRouterGroup, h *handler.Bundle) { appRouterGroup.AuthRouterGroup.GET("/inbox", h.InboxHandler.GetInboxList()) appRouterGroup.AuthRouterGroup.GET("/inbox/unread", h.InboxHandler.GetUnreadInbox()) appRouterGroup.AuthRoute