Ech0 exposes an unauthenticated API endpoint that accepts any URL and fetches it without validation. The outbound HTTP client disables certificate verification and imposes no host restriction, allowing an attacker to request internal or privileged URLs through the server, retrieve arbitrary data, and exfiltrate it via the API response. This constitutes a Server‑Side Request Forgery vulnerability (CWE‑918).

The vulnerability affects all Ech0 instances running version 4.2.7 or earlier. The affected product is the Ech0 self‑hosted publishing platform, which is open source and publicly hosted. Any deployment exposing the API endpoint to external networks is susceptible, regardless of the underlying platform or operating system.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% shows low current exploitation prevalence. The vulnerability is not listed in CISA’s KEV catalog. Attackers can trigger the SSRF by simply sending an HTTP request to the exposed endpoint; no special privileges are required. The potential for accessing internal services depends on the server’s network environment, meaning the risk is contingent on how the Ech0 instance is networked and exposed.