github.com/lin-snow/ech0 vulnerabilities
CVEs whose affected-version data names the github.com/lin-snow/ech0 package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
16 CVEsRSS
CVE-2026-79669Medium· 4.3Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs
Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, G…
CVE-2026-79664High· 7.4PoCEch0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft
Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on ni…
GO-2026-5981NoneEch0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com…
Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware in github.com/lin-snow/ech0
GHSA-mqxv-9rm6-w8qcHighEch0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware
Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware
CVE-2026-79660Medium· 5.3Ech0 comment model's Email field returned on public /api/comments endpoints
Ech0 comment model's Email field returned on public /api/comments endpoints
CVE-2026-79668Medium· 5.3Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation
Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation
CVE-2026-79661Medium· 6.5Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_count
Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_count
CVE-2026-79662High· 8.0Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theft
Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theft
CVE-2026-79663Medium· 4.8Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers
Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers
GHSA-fpw6-hrg5-q5x5High· 7.4ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI
ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI
CVE-2026-79671Medium· 5.5Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation
Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation
CVE-2026-79673Medium· 6.5Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session
Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session
CVE-2026-79672Medium· 5.5Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass
Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass
CVE-2026-79666Medium· 6.5Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs
Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs
CVE-2026-79670Medium· 4.8Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload
Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload
CVE-2026-79667High· 7.6Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export
Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export