Technical impact
The Vulnerability allows any authenticated non‑administrative user to read all server logs via the system log endpoints. By accessing GET /api/system/logs, GET /api/system/logs/stream, and the websocket /ws/system/logs, an attacker can obtain historical log entries and real‑time streams that contain internal file paths, error stack traces, and other application state information. This lack of authorization checks on the log interfaces is a concrete example of CWE‑862 – Missing Authorization, resulting in a moderate‑level information disclosure risk.
Affected Systems
The affected product is Ech0, developed by lin‑snow, for any release version prior to 4.4.3. An update to 4.4.3 or later contains the necessary authorization checks that prevent this misuse of the logs.
Risk and Exploitability
With a CVSS score of 5.3 this vulnerability presents a moderate severity risk. The EPSS score is not available, but the lack of a KEV listing suggests it has not yet been widely exploited. The exploit requires the attacker to be authenticated, but no administrative privileges are necessary; the attacker can trigger the vulnerable endpoints with any user credential and read sensitive data from the logs. Because the compromised data can be used for reconnaissance, the risk is primarily information disclosure rather than active sabotage.
