Description
A vulnerability was detected in EchoHS GeekezBrowser up to 1.7.2/1.8.0. This affects an unknown part of the file /api/status of the component Public API. The manipulation results in information disclosure. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 1.8.1 is able to mitigate this issue. The patch is identified as 9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e. Upgrading the affected component is recommended.
Published: 2026-11-02
Score: 4.8 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized Information Disclosure
Action: Apply Patch
AI Analysis

Impact

An attacker can manipulate the /api/status endpoint of EchoHS GeekezBrowser to retrieve sensitive status information that should not be publicly exposed. The vulnerability is classified as an information disclosure flaw (CWE‑200) and can be abused when the attacker has local access to the system.

Affected Systems

EchoHS GeekezBrowser versions up to and including 1.7.2 and 1.8.0 are affected. The issue resides in an undisclosed part of the component Public API /api/status and removing the vulnerability requires upgrading to version 1.8.1.

Risk and Exploitability

The CVSS score is 4.8, indicating moderate risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attack requires local access, so exposure is limited to locally compromised systems; however, the exploit is public and could be readily used by attackers with such access.

Generated by OpenCVE AI on November 2, 2026 at 21:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade EchoHS GeekezBrowser to version 1.8.1 or later.
  • If upgrading is not possible, restrict local access to the /api/status endpoint to authorized users only to mitigate the authority‑control weakness (CWE‑284).
  • Limit local account privileges to prevent unauthorized use of the Public API if the endpoint cannot be secured immediately.

Generated by OpenCVE AI on November 2, 2026 at 21:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 20:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in EchoHS GeekezBrowser up to 1.7.2/1.8.0. This affects an unknown part of the file /api/status of the component Public API. The manipulation results in information disclosure. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 1.8.1 is able to mitigate this issue. The patch is identified as 9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e. Upgrading the affected component is recommended.
Title EchoHS GeekezBrowser Public API status information disclosure
First Time appeared Echohs
Echohs geekezbrowser
Weaknesses CWE-200
CWE-284
CPEs cpe:2.3:a:echohs:geekezbrowser:*:*:*:*:*:*:*:*
Vendors & Products Echohs
Echohs geekezbrowser
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Echohs Geekezbrowser
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-02T20:30:18.122Z

Reserved: 2026-11-02T15:32:24.364Z

Link: CVE-2026-120503

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-02T21:17:30.190

Modified: 2026-11-02T21:17:30.380

Link: CVE-2026-120503

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-02T22:45:17Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control