Lin Snow Ech0: Fifteen Auth, SSRF, and XSS Flaws Disclosed Together
A coordinated disclosure on August 25, 2026, revealed fifteen vulnerabilities in Lin Snow's Ech0 product, ranging from Medium to High severity, impacting authentication, authorization, and data integrity.
Key findings
- Fifteen CVEs disclosed on August 25, 2026, affecting Lin Snow's Ech0 product across multiple versions.
- Vulnerabilities include authorization bypass, improper scope enforcement, and authentication flaws.
- High severity issues allow unauthorized access to admin functions, sensitive data, and perpetual token access.
- Stored XSS and SSRF vulnerabilities present risks through file uploads and unvalidated requests.
- Affected versions range widely; users urged to update to patched releases like 4.4.3, 4.5.1, 4.5.6, or 4.7.3.
On August 25, 2026, a batch of fifteen vulnerabilities was disclosed for Lin Snow's Ech0 product, spanning multiple versions and impacting authentication, authorization, and data handling. The vulnerabilities, all disclosed on the same day, range in severity from Medium to High, with several critical flaws allowing for significant unauthorized access and data exposure. This coordinated disclosure highlights potential weaknesses in Ech0's security posture across its API endpoints and core functionalities.
Several vulnerabilities revolve around authorization bypass and improper scope enforcement. CVE-2026-79667, a High severity flaw, details how Ech0 versions 4.3.4 and earlier fail to reliably enforce least-privilege restrictions on privileged admin routes, allowing users with only an admin role to access sensitive endpoints like backup exports. Similarly, CVE-2026-79665 (High, CVSSv3 8.8) affects Ech0 versions before 4.5.1, where session tokens bypass scope validation, enabling logged-in non-admin users to access admin endpoints and sensitive data such as system logs and user emails. CVE-2026-79673 (Medium, CVSSv3 6.5) points out a critical flaw in the PUT /user endpoint, where a read-only scope is incorrectly used to protect write operations, allowing an attacker with a profile:read token to change an admin's password and gain full control. CVE-2026-79672 (Medium, CVSSv3 5.5) describes how nine comment panel admin endpoints fail to enforce scope-based authorization, allowing minimal scope tokens to perform full moderation.
Further complicating the security landscape are vulnerabilities related to authentication and session management. CVE-2026-79664 (High, CVSSv3 7.4) addresses an issue in Ech0 versions before 4.7.3 where access tokens created with a "never-expire" option are not properly revoked, potentially allowing attackers perpetual access after token theft. CVE-2026-79668 (Medium, CVSSv3 5.3) and CVE-2026-79661 (Medium, CVSSv3 6.5) both highlight an unprotected PUT /api/echo/like/:id endpoint, allowing unauthenticated attackers to arbitrarily increment engagement metrics. CVE-2026-79662 (High, CVSSv3 8.0) involves an OAuth redirect URI validation vulnerability in versions through 4.5.6, where only the scheme and host are compared, potentially leading to open redirect attacks.
Data exposure and injection vulnerabilities are also present. CVE-2026-79669 (Medium, CVSSv3 4.3) and CVE-2026-79666 (Medium, CVSSv3 6.5) both describe vulnerabilities in system log endpoints, allowing authenticated non-admin users or any authenticated user, respectively, to access sensitive system logs and operational data. CVE-2026-79660 (Medium, CVSSv3 5.3) reveals that guest commenter email addresses are exposed through public API endpoints in versions before 4.7.3 due to improper serialization tags. Stored cross-site scripting (XSS) vulnerabilities are present in CVE-2026-79670 (Medium, CVSSv3 4.8), where the file upload endpoint validates Content-Type using only client-supplied headers, allowing for malicious file uploads. Another XSS vulnerability, CVE-2026-79663 (Medium, CVSSv3 4.8), exists in the public RSS feed, where tag names and markdown content are rendered without HTML escaping.
Server-side request forgery (SSRF) is another theme within this batch. CVE-2026-79671 (Medium, CVSSv3 5.5) details an SSRF vulnerability in the validateWebhookURL function, which fails to reject hostnames that resolve to private IPs. CVE-2026-79659 (High, CVSSv3 7.7) describes an SSRF vulnerability in the fetchPeerConnectInfo function, allowing authenticated attackers to access internal services and cloud metadata endpoints by triggering unvalidated HTTP requests.
The affected versions span a wide range, with patches and fixes available in Ech0 versions 4.4.3, 4.5.1, 4.5.6, and 4.7.3, depending on the specific vulnerability. Users are strongly advised to update to the latest available versions to mitigate these risks. The coordinated disclosure of these fifteen vulnerabilities underscores the importance of regular security audits and prompt patching for all users of the Ech0 platform.
This extensive batch of vulnerabilities, all disclosed on the same day, indicates a significant security event for Ech0 users. The breadth of issues, from authentication bypass to SSRF and XSS, necessitates immediate attention from administrators to ensure the integrity and confidentiality of their data and systems. Staying updated with vendor advisories and applying patches promptly is crucial for maintaining a secure environment.