Description
Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data including file paths, stack traces, and internal URLs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| lin-snow | Ech0 | < 4.4.3 | 4.4.3 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/lin-snow/ech0 | < 4.3.5 | 4.3.5 | GHSA-cp79-9mwr-wr49 |
| Go | github.com/lin-snow/ech0 | all versions | — | GO-2026-5328 |
References
- GitHub Security Advisory (GHSA-cp79-9mwr-wr49) vendor-advisory
- VulnCheck Advisory: Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints third-party-advisory