CVE-2026-79666CWE-862broken-access-control

CVE-2026-79666

Medium · published August 25, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
31.3
In the wild
Unconfirmed
What it is

Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data including file paths, stack traces, and internal URLs.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00385 · 31.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-25T16:16Z
References (3)
https://github.com/lin-snow/Ech0/security/advisories/GHSA-cp79-9mwr-wr49 · [email protected]https://www.vulncheck.com/advisories/ech0-before-missing-authorization-via-dashboard-log-endpoints · [email protected]https://github.com/lin-snow/Ech0/security/advisories/GHSA-cp79-9mwr-wr49 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 AUG 06:46Z
    EPSS moved — → 0%
    epss
  • 25 AUG 11:33Z
    Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints
    cvelistv5