{"id":"CVE-2026-79660","state":"PUBLISHED","title":"Ech0 before 4.7.3 Email Disclosure via Public API","description":"Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Unauthenticated attackers can harvest all commenter emails by calling the /api/comments and /api/comments/public endpoints without authentication.","publishedAt":"2026-08-25T11:33:24.692Z","updatedAt":"2026-08-25T15:32:51.102Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["lin-snow Ech0"],"affected":[{"vendor":"lin-snow","product":"Ech0","packageURL":"pkg:golang/github.com/lin-snow/Ech0","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.7.3","versionType":"semver"},{"version":"4.7.3","status":"unaffected","versionType":"semver"}]}],"references":["https://github.com/lin-snow/Ech0/security/advisories/GHSA-rj4g-rqgh-rx9h","https://www.vulncheck.com/advisories/ech0-before-email-disclosure-via-public-api"],"weaknesses":["CWE-200"],"ingestedAt":"2026-10-29T20:13:07.220Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/79xxx/CVE-2026-79660.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-79660","state":"PUBLISHED","datePublished":"2026-08-25T11:33:24.692Z","dateUpdated":"2026-08-25T15:32:51.102Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-08-25T11:09:11.171Z"},"containers":{"cna":{"title":"Ech0 before 4.7.3 Email Disclosure via Public API","descriptions":[{"lang":"en","value":"Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Unauthenticated attackers can harvest all commenter emails by calling the /api/comments and /api/comments/public endpoints without authentication."}],"affected":[{"vendor":"lin-snow","product":"Ech0","packageURL":"pkg:golang/github.com/lin-snow/Ech0","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.7.3","versionType":"semver"},{"version":"4.7.3","status":"unaffected","versionType":"semver"}]}],"references":[{"url":"https://github.com/lin-snow/Ech0/security/advisories/GHSA-rj4g-rqgh-rx9h","tags":["vendor-advisory"],"name":"GitHub Security Advisory (GHSA-rj4g-rqgh-rx9h)"},{"url":"https://www.vulncheck.com/advisories/ech0-before-email-disclosure-via-public-api","name":"VulnCheck Advisory: Ech0 before 4.7.3 Email Disclosure via Public API","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":6.9,"baseSeverity":"MEDIUM"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","lang":"en","description":"Exposure of Sensitive Information to an Unauthorized Actor","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-08-25T11:33:24.692Z"},"datePublic":"2026-05-03T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ech0:ech0:*:*:*:*:*:*:*:*","versionEndExcluding":"4.7.3"}]}]}],"credits":[{"lang":"en","value":"adrgs","type":"reporter"},{"lang":"en","value":"aisafe-bot","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/lin-snow/Ech0/security/advisories/GHSA-rj4g-rqgh-rx9h","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-25T15:32:42.877836Z","id":"CVE-2026-79660","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-25T15:32:51.102Z"}}]}}}