CVE-2026-79666
Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints
- State
- Published
- Severity
- 7.1 High
- Published
- Aug 25, 2026
- Updated
- Aug 27, 2026
- Reserved
- Aug 25, 2026
Description
Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data including file paths, stack traces, and internal URLs.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
Ech0lin-snow |
|
References
- GitHub Security Advisory (GHSA-cp79-9mwr-wr49)vendor-advisory
- VulnCheck Advisory: Ech0 before 4.4.3 Missing Authorization via dashboard log endpointsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.