Ech0 versions before 4.7.3 expose the email addresses of all guest commenters through public API endpoints. The vulnerability stems from improper JSON serialization tags on the Comment model, which causes every email to be returned in the API response. Because the endpoint is publicly accessible, an unauthenticated attacker can retrieve a complete list of commenter emails, resulting in a disclosure of sensitive personal information.

The affected product is Ech0 from lin-snow. All releases earlier than version 4.7.3 are vulnerable. No specific sub‑versions are listed; any deployment using a pre‑4.7.3 release is at risk.

The CVSS score of 6.9 indicates a moderate to high impact. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. An attacker can exploit the flaw by sending unauthenticated HTTP requests to the /api/comments and /api/comments/public endpoints, which return email data in JSON format. Given that the endpoints are publicly reachable and that no authentication is required, the likelihood of exploitation is substantive and the exploited data directly compromises user confidentiality.