{"id":"GO-2026-5701","revision":null,"records":[{"revision":"1b358d930d334768ae1281fde874ca55","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-79669","aliases":[],"title":"Ech0 before 4.4.3 Missing Authorization on System Logs","description":"Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather reconnaissance data including internal file paths, error stack traces, and application state.","state":0,"publishedAt":"2026-08-25T11:33:30.826+00:00","modifiedAt":"2026-08-25T12:57:52.706+00:00","affected":[{"ecosystem":"Vendor product","name":"Ech0","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"lin-snow\",\n                    \"product\": \"Ech0\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/github.com/lin-snow/ech0\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"4.4.3\"\n                        },\n                        {\n                            \"version\": \"4.4.3\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":5.3,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://github.com/lin-snow/Ech0/security/advisories/GHSA-w8jj-cwmc-wgq2","https://www.vulncheck.com/advisories/ech0-before-missing-authorization-on-system-logs"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-79669","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-79669","identifiers":["CVE-2026-79669"]},"retained":false,"historicalAffected":[]},{"revision":"84307c02a59243398902d877cf631a3d","observedAt":"2026-11-11T16:09:45.763+00:00","statement":{"source":"euvd","id":"EUVD-2026-65445","aliases":["CVE-2026-79669","GHSA-vw9j-c9ff-mwf8"],"title":"Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET …","description":"Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather reconnaissance data including internal file paths, error stack traces, and application state.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":5.3,"severity":null}],"references":["https://github.com/lin-snow/Ech0/security/advisories/GHSA-w8jj-cwmc-wgq2","https://www.vulncheck.com/advisories/ech0-before-missing-authorization-on-system-logs"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-65445","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 25, 2026, 11:33:30 AM","dateUpdated":"Aug 25, 2026, 12:57:52 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-65445","identifiers":["EUVD-2026-65445","CVE-2026-79669","GHSA-vw9j-c9ff-mwf8"]},"retained":false,"historicalAffected":[]},{"revision":"18dc28b4143744a5b9e1aefd0ff149a7","observedAt":"2026-10-25T16:19:04.694+00:00","statement":{"source":"nvd","id":"CVE-2026-79669","aliases":[],"title":"Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET …","description":"Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather reconnaissance data including internal file paths, error stack traces, and application state.","state":0,"publishedAt":"2026-08-25T12:16:35.107+00:00","modifiedAt":"2026-09-23T18:14:58.577+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":5.3,"severity":"MEDIUM"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://github.com/lin-snow/Ech0/security/advisories/GHSA-w8jj-cwmc-wgq2","https://www.vulncheck.com/advisories/ech0-before-missing-authorization-on-system-logs"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79669","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-862"],"productCriteria":[],"sourceDates":{"published":"2026-08-25T12:16:35.107","lastModified":"2026-09-23T18:14:58.577"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-79669","identifiers":["CVE-2026-79669"]},"retained":false,"historicalAffected":[]},{"revision":"cd1df77d64e14a13a8e2c5603f9a6e59","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-w8jj-cwmc-wgq2","aliases":["CVE-2026-79669","GO-2026-5701"],"title":"Ech0's Missing Authorization on System Logs Allows Non-Admin Information Disclosure","description":"## Summary\n\nThe system log endpoints (`GET /api/system/logs`, `GET /api/system/logs/stream`, `WS /ws/system/logs`) lack authorization checks, allowing any authenticated non-admin user to read and stream all server logs. These logs contain error stack traces, internal file paths, module names, and arbitrary structured fields that facilitate reconnaissance for further attacks.\n\n## Details\n\nThe dashboard routes in `internal/router/dashboard.go:7-8` register log endpoints on the `AuthRouterGroup` without any `RequireScopes` middleware:\n\n```go\n// internal/router/dashboard.go\nfunc setupDashboardRoutes(appRouterGroup *AppRouterGroup, h *handler.Bundle) {\n\tappRouterGroup.AuthRouterGroup.GET(\"/system/logs\", h.DashboardHandler.GetSystemLogs())\n\tappRouterGroup.AuthRouterGroup.GET(\"/system/logs/stream\", h.DashboardHandler.SSESubscribeSystemLogs())\n\tappRouterGroup.WSRouterGroup.GET(\"/system/logs\", h.DashboardHandler.WSSubscribeSystemLogs())\n}\n```\n\nCompare with other admin-only routes that properly use `RequireScopes`:\n\n```go\n// internal/router/setting.go — every route has RequireScopes\nappRouterGroup.AuthRouterGroup.GET(\"/settings\",\n    middleware.RequireScopes(authModel.ScopeAdminSettings),\n    h.SettingHandler.GetSiteSettings())\n```\n\nThe `AuthRouterGroup` only applies `JWTAuthMiddleware()` (router.go:36), which validates the JWT and sets the viewer context but does **not** check admin status. The `WSRouterGroup` (router.go:37) has no middleware at all — the WebSocket handler only calls `ParseToken` to verify the JWT signature (dashboard.go:74) without any role/scope validation.\n\nThe handler (`internal/handler/dashboard/dashboard.go:29-62`) and service (`internal/service/dashboard/dashboard.go:21-27`) contain zero authorization checks. Other services in the codebase properly enforce admin access:\n- `internal/service/inbox/inbox.go:132` — `ensureAdmin()`\n- `internal/service/migrator/migrator.go:360` — `ensureAdmin()`\n- `internal/service/comment/comment.go:719` — `requireAdmin()`\n\nNon-admin users are created with `IsAdmin: false` and `IsOwner: false` (`internal/service/user/user.go:220-221`) via the public registration endpoint.\n\nThe `LogEntry` struct (`internal/util/log/log.go:78-87`) exposes:\n```go\ntype LogEntry struct {\n    Time   string         `json:\"time\"`\n    Level  string         `json:\"level\"`\n    Msg    string         `json:\"msg\"`\n    Module string         `json:\"module,omitempty\"`\n    Caller string         `json:\"caller,omitempty\"`   // internal file paths\n    Error  string         `json:\"error,omitempty\"`     // error stack traces\n    Fields map[string]any `json:\"fields,omitempty\"`    // arbitrary structured data\n    Raw    string         `json:\"raw,omitempty\"`       // raw log lines\n}\n```\n\n## PoC\n\n```bash\n# 1. Register a non-admin user (system allows up to 5 users by default)\ncurl -X POST http://localhost:8080/api/register \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"username\":\"attacker\",\"password\":\"Password123\"}'\n\n# 2. Login to get session token\nTOKEN=$(curl -s -X POST http://localhost:8080/api/login \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"username\":\"attacker\",\"password\":\"Password123\"}' | jq -r '.data.token')\n\n# 3. Read system logs — should require admin but doesn't\ncurl http://localhost:8080/api/system/logs \\\n  -H \"Authorization: Bearer $TOKEN\"\n# Returns: {\"code\":1,\"data\":[{\"time\":\"...\",\"level\":\"error\",\"msg\":\"...\",\"module\":\"...\",\"caller\":\"internal/service/user/user.go:145\",\"error\":\"...\",\"fields\":{...}},...]}\n\n# 4. Subscribe to real-time log stream via SSE\ncurl -N \"http://localhost:8080/api/system/logs/stream?token=$TOKEN\"\n\n# 5. Subscribe via WebSocket (WSRouterGroup has NO middleware)\n# wscat -c \"ws://localhost:8080/ws/system/logs?token=$TOKEN\"\n```\n\n## Impact\n\nAny registered non-admin user can:\n- **Read all historical system logs** including error traces that reveal internal code paths, database errors, and application state\n- **Stream real-time logs** via SSE or WebSocket to monitor all server activity as it happens\n- **Gather reconnaissance data** — caller fields expose internal file paths and line numbers, error fields expose stack traces and database query failures, module fields map the internal architecture\n- **Monitor other users' actions** — authentication failures, registration events, and admin operations appear in logs\n\nThis information disclosure lowers the bar for chaining further attacks by revealing the application's internal structure, error handling patterns, and operational state.\n\n## Recommended Fix\n\nAdd `RequireScopes` middleware with an admin scope to the dashboard routes:\n\n```go\n// internal/router/dashboard.go\nfunc setupDashboardRoutes(appRouterGroup *AppRouterGroup, h *handler.Bundle) {\n\tappRouterGroup.AuthRouterGroup.GET(\"/system/logs\",\n\t\tmiddleware.RequireScopes(authModel.ScopeAdminSettings),\n\t\th.DashboardHandler.GetSystemLogs())\n\tappRouterGroup.AuthRouterGroup.GET(\"/system/logs/stream\",\n\t\tmiddleware.RequireScopes(authModel.ScopeAdminSettings),\n\t\th.DashboardHandler.SSESubscribeSystemLogs())\n\tappRouterGroup.WSRouterGroup.GET(\"/system/logs\",\n\t\tmiddleware.RequireScopes(authModel.ScopeAdminSettings),\n\t\th.DashboardHandler.WSSubscribeSystemLogs())\n}\n```\n\nAdditionally, the WebSocket handler should validate admin scope after parsing the token, since the `WSRouterGroup` lacks middleware:\n\n```go\n// internal/handler/dashboard/dashboard.go — WSSubscribeSystemLogs\nclaims, err := jwtUtil.ParseToken(token)\nif err != nil {\n    ctx.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{\"msg\": \"invalid token\"})\n    return\n}\n// Add admin check for WebSocket endpoint\nif claims.TokenType == authModel.TokenTypeAccess && !containsScope(claims.Scopes, authModel.ScopeAdminSettings) {\n    ctx.AbortWithStatusJSON(http.StatusForbidden, gin.H{\"msg\": \"admin access required\"})\n    return\n}\n```","state":0,"publishedAt":"2026-04-10T19:49:33+00:00","modifiedAt":"2026-08-27T03:55:29.1672191+00:00","affected":[{"ecosystem":"Go","name":"github.com/lin-snow/ech0","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.4.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/lin-snow/Ech0/security/advisories/GHSA-w8jj-cwmc-wgq2","https://github.com/lin-snow/Ech0","https://github.com/lin-snow/Ech0/releases/tag/v4.4.3"],"sourceUrl":"https://github.com/advisories/GHSA-w8jj-cwmc-wgq2","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-w8jj-cwmc-wgq2","identifiers":["GHSA-w8jj-cwmc-wgq2","CVE-2026-79669","GO-2026-5701"]},"retained":false,"historicalAffected":[]},{"revision":"83e23c7e60bc4fa2ba2e76f627885c7a","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5701","aliases":["CVE-2026-79669","GHSA-w8jj-cwmc-wgq2"],"title":"Ech0's Missing Authorization on System Logs Allows Non-Admin Information Disclosure in github.com/lin-snow/ech0","description":"Ech0's Missing Authorization on System Logs Allows Non-Admin Information Disclosure in github.com/lin-snow/ech0.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/lin-snow/ech0 before v4.4.3.","state":0,"publishedAt":"2026-06-25T22:34:38+00:00","modifiedAt":"2026-08-27T03:55:29.1672191+00:00","affected":[{"ecosystem":"Go","name":"github.com/lin-snow/ech0","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/lin-snow/Ech0/security/advisories/GHSA-w8jj-cwmc-wgq2","https://github.com/lin-snow/Ech0/releases/tag/v4.4.3"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5701","license":"OSV · upstream source license applies","key":"osv:GO-2026-5701","identifiers":["GO-2026-5701","CVE-2026-79669","GHSA-w8jj-cwmc-wgq2"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T18:18:51.9610599+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T18:18:51.9610599+00:00","lastSuccessAt":"2026-11-12T18:18:52.1359793+00:00","error":null,"lastVerifiedAt":"2026-11-12T18:18:52.1359803+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-436983018a0f2d42a11c05b3b04ba98c8ad3664129731f383f79e8cf6a19e2f9","complete":true,"records":424774,"lastAttemptAt":"2026-11-12T18:16:42.0266239+00:00","lastSuccessAt":"2026-11-12T18:16:41.2671502+00:00","error":null,"lastVerifiedAt":"2026-11-12T18:16:42.0266239+00:00","snapshotPublishedAt":"2026-11-12T17:19:00+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-a6bc4e59bf274de6bccd2bd795defd8b","complete":true,"records":13775,"lastAttemptAt":"2026-11-12T18:19:15.1587038+00:00","lastSuccessAt":"2026-11-12T18:19:15.154+00:00","error":null,"lastVerifiedAt":"2026-11-12T18:19:15.154+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13828,"expectedIdentifiers":13828,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T18:18:51.9610599+00:00","complete":true,"records":1123,"lastAttemptAt":"2026-11-12T18:18:51.9610599+00:00","lastSuccessAt":"2026-11-12T18:18:54.878817+00:00","error":null,"lastVerifiedAt":"2026-11-12T18:18:54.8788175+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c74733ed0c2f4bb3aa28f2921b528eb9","complete":true,"records":13775,"lastAttemptAt":"2026-11-12T18:19:14.2859916+00:00","lastSuccessAt":"2026-11-12T18:19:14.282+00:00","error":null,"lastVerifiedAt":"2026-11-12T18:19:14.282+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13828,"expectedIdentifiers":13828,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T18:18:51.9148238+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T18:18:51.9148238+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-4d60731753a2f72e455d1086e7203d0ef10843936dcc1cf2b45135e2caa204b0","complete":true,"records":2012,"lastAttemptAt":"2026-11-12T18:16:50.9322629+00:00","lastSuccessAt":"2026-11-12T18:16:50.7862525+00:00","error":null,"lastVerifiedAt":"2026-11-12T18:16:50.9322629+00:00","snapshotPublishedAt":"2026-11-12T17:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-0d57668ba92a2918d0664e89ea91d467f8e6a2bc6330923eb883b74ac42a14ec","complete":true,"records":3125,"lastAttemptAt":"2026-11-12T18:18:51.9276914+00:00","lastSuccessAt":"2026-11-12T15:18:36.6112732+00:00","error":null,"lastVerifiedAt":"2026-11-12T18:18:51.9276914+00:00","snapshotPublishedAt":"2026-11-12T14:48:37+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-5f552124b4be907bc00a2f540b60dd82b393dc198845ddee9ca4af23654583f8","complete":true,"records":231722,"lastAttemptAt":"2026-11-12T18:18:51.6701113+00:00","lastSuccessAt":"2026-11-12T18:18:50.0151941+00:00","error":null,"lastVerifiedAt":"2026-11-12T18:18:51.6701113+00:00","snapshotPublishedAt":"2026-11-12T17:33:22+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}