An unauthenticated GET request to the public /api/allusers endpoint returns full user records, exposing personal profile details such as usernames and metadata; the flaw is a missing authentication check (CWE-862) that allows remote users to enumerate accounts without credentials, potentially enabling social engineering or identity theft but does not provide code execution or data modification rights.

The Ech0 open‑source publishing platform, versions prior to v4.2.0, is affected; the vulnerable product is Ech0, hosted by lin‑snow, and any deployment running an unpatched instance of Ech0 before the v4.2.0 release can be impacted.

The vulnerability has a CVSS base score of 5.3 indicating moderate severity; the EPSS score is below 1% suggesting low likelihood of exploitation, and it is not present in the CISA KEV catalog; the attack vector is remote over HTTP/HTTPS, requiring no local privileges, and exploitation yields exposure of all user records but no alteration or code execution capabilities.