CVE-2026-79673 | Medium | 6.5 | 2026-08-25 | Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An at… |
CVE-2026-79672 | Medium | 5.5 | 2026-08-25 | Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full… |
CVE-2026-79671 | Medium | 5.5 | 2026-08-25 | Ech0 through 4.2.1 contains a server-side request forgery vulnerability in the validateWebhookURL function (webhook_setting_service.go), which only validates l… |
CVE-2026-79670 | Medium | 4.8 | 2026-08-25 | Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only client-supplied heade… |
CVE-2026-79669 | Medium | 4.3 | 2026-08-25 | Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers ca… |
CVE-2026-79668 | Medium | 5.3 | 2026-08-25 | Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment eng… |
CVE-2026-79667 | High | 7.6 | 2026-08-25 | Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token (least-privilege) restrictions on several privileged admin routes. Multiple privil… |
CVE-2026-79666 | Medium | 6.5 | 2026-08-25 | Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers wit… |
CVE-2026-79665 | High | 8.8 | 2026-08-25 | Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non… |
CVE-2026-79664 | High | 7.4 | 2026-08-25 | Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after… |
CVE-2026-79663 | Medium | 4.8 | 2026-08-25 | Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML es… |
CVE-2026-79662 | High | 8.0 | 2026-08-25 | Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect (internal/service/auth/auth.go) that compares only… |
CVE-2026-79661 | Medium | 6.5 | 2026-08-25 | Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers… |
CVE-2026-79660 | Medium | 5.3 | 2026-08-25 | Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Un… |
CVE-2026-79659 | High | 7.7 | 2026-08-25 | Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe… |
CVE-2026-79658 | High | 7.5 | 2026-08-25 | Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The… |
CVE-2026-77151 | Low | 3.7 | 2026-08-20 | A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of the file internal/util/crypto/crypto.go… |
CVE-2026-35037 | High | 7.2 | 2026-04-06 | Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, the GET /api/website/title endpoint accepts an arbitrary URL… |
CVE-2026-35036 | High | 7.5 | 2026-04-06 | Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, Ech0 implements link preview (editor fetches a page title) t… |
CVE-2026-33638 | Medium | 5.3 | 2026-03-26 | Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to version 4.2.0, `GET /api/allusers` is mounted as a public endpoint… |