CVE-2026-79666 — Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints
Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessi…
Published: 2026-08-25 · CVSS: 7.1 · CVSS 4.0
Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data including file paths, stack traces, and internal URLs.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7