HIGH 7.1 NVD
CVE-2026-79666
Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with
Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data including file paths, stack traces, and internal URLs.
References
- https://github.com/lin-snow/Ech0/security/advisories/GHSA-cp79-9mwr-wr49
- https://www.vulncheck.com/advisories/ech0-before-missing-authorization-via-dashboard-log-e
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-08-25 via NVD.
vulnfeed aggregates 12116 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.