Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck

CVE-2026-79666Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints

Medium 6.5

In plain English

A medium-severity missing authorization in Ech0 from lin-snow. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 67.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data including file paths, stack traces, and internal URLs.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/lin-snow/ech0	4.3.5	GHSA-cp79-9mwr-wr49
Go	github.com/lin-snow/ech0	no fix listed	GO-2026-5328

Affected products (as reported)

Vendor	Product	Versions
lin-snow	Ech0	0 – before 4.4.3

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-cp79-9mwr-wr49) vendor-advisory
VulnCheck Advisory: Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints third-party-advisory