Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck

CVE-2026-79669Ech0 before 4.4.3 Missing Authorization on System Logs

Medium 4.3

In plain English

A medium-severity missing authorization in Ech0 from lin-snow. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 79.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather reconnaissance data including internal file paths, error stack traces, and application state.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/lin-snow/ech0	4.4.3	GHSA-w8jj-cwmc-wgq2
Go	github.com/lin-snow/ech0	no fix listed	GO-2026-5701

Affected products (as reported)

Vendor	Product	Versions
lin-snow	Ech0	0 – before 4.4.3

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-w8jj-cwmc-wgq2) vendor-advisory
VulnCheck Advisory: Ech0 before 4.4.3 Missing Authorization on System Logs third-party-advisory