Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-79666

Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data including file paths, stack traces, and internal URLs.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

lin-snow Ech0

Default version status: unaffected

  • 0 to < 4.4.3affected
  • 4.4.3unaffected
pkg:golang/github.com/lin-snow/ech0

References