Description
Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data including file paths, stack traces, and internal URLs.
Published: 2026-08-25
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Description Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data including file paths, stack traces, and internal URLs.
Title Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints
First Time appeared Ech0
Ech0 ech0
Weaknesses CWE-862
CPEs cpe:2.3:a:ech0:ech0:*:*:*:*:*:*:*:*
Vendors & Products Ech0
Ech0 ech0
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Ech0 Ech0
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-25T11:33:28.747Z

Reserved: 2026-08-25T11:09:11.171Z

Link: CVE-2026-79666

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-25T12:16:34.670

Modified: 2026-08-25T12:16:34.670

Link: CVE-2026-79666

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses