Ech0 is a self‑hosted publishing platform that, before version 4.2.0, exposed a REST endpoint at GET /api/allusers. This endpoint was publicly accessible and returned a list of user records without requiring any authentication. The exposed data includes user profile metadata. An attacker can therefore enumerate users and retrieve personal information that could be used for phishing, social engineering, or other malicious activities. The underlying weakness aligns with CWE‑862, a user identification or authentication failure.

The affected product is Ech0, an open‑source platform provided by lin‑snow. Versions older than 4.2.0 are vulnerable; the fix was released with Ech0 v4.2.0.

The CVSS score of 5.3 indicates a moderate impact. No EPSS data is published, so the likelihood of exploitation cannot be quantified. According to the information available, the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting that at present there is no evidence of active exploitation. The attack vector is clearly remote, requiring only unauthenticated access to the public endpoint. An attacker can trivially trigger the vulnerability by sending a simple HTTP GET request and obtain the data returned in the response.