Vulnerability · Published Mar 26, 2026 · Assigned by GitHub_M

CVE-2026-33638Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint

Medium 5.3

In plain English

A medium-severity missing authorization in Ech0 from lin-snow. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 56.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to version 4.2.0, `GET /api/allusers` is mounted as a public endpoint and returns user records without authentication. This allows remote unauthenticated user enumeration and exposure of user profile metadata. A fix is available in v4.2.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/lin-snow/ech0	1.4.8-0.20260322121226-acbf1fd71011	GHSA-m983-7426-5hrj
Go	github.com/lin-snow/ech0	1.4.8-0.20260322121226-acbf1fd71011	GO-2026-4838

Affected products (as reported)

Vendor	Product	Versions
lin-snow	Ech0	< 4.2.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/lin-snow/Ech0/security/advisories/GHSA-m983-7426-5hrj x_refsource_CONFIRM
https://github.com/lin-snow/Ech0/commit/acbf1fd71011e6b9e1e6a911128056a19862f681 x_refsource_MISC
https://github.com/lin-snow/Ech0/releases/tag/v4.2.0 x_refsource_MISC