Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-79660

Ech0 before 4.7.3 Email Disclosure via Public API

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Unauthenticated attackers can harvest all commenter emails by calling the /api/comments and /api/comments/public endpoints without authentication.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

lin-snow Ech0

Default version status: unaffected

  • 0 to < 4.7.3affected
  • 4.7.3unaffected
pkg:golang/github.com/lin-snow/Ech0

References