CVE-2026-79666: falha de alta gravidade em lin-snow Ech0
Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints
Publicada em · Atualizada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.4%
probabilidade de exploração
0.4%top 68% das CVEs
exploração observada
nãonenhuma fonte reporta
Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data including file paths, stack traces, and internal URLs.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
lin-snow · Ech0CVEs relacionadas — lin-snow Ech0
No mesmo produto, das mais perigosas para as menos.
CVE-2026-35037HIGHEch0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadataEPSS 0.6%CVE-2026-79665HIGHEch0 before 4.5.1 Authorization Bypass via Session TokensEPSS 0.5%CVE-2026-79658HIGHEch0 before 5.0.1 Denial of Service via Accept-LanguageEPSS 0.5%CVE-2026-33638MEDIUMEch0 authenticated user-list exposed data via public `/api/allusers` endpointEPSS 0.5%CVE-2026-79668MEDIUMEch0 before 4.7.3 Unauthenticated Like Endpoint Metric InflationEPSS 0.4%CVE-2026-79661MEDIUMEch0 before 4.7.3 Unauthenticated fav_count ModificationEPSS 0.4%