Medium severity6.5NVD Advisory· Published Aug 25, 2026· Updated Aug 31, 2026
CVE-2026-79666
CVE-2026-79666
Description
Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data including file paths, stack traces, and internal URLs.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
1- Lin Snow Ech0: Fifteen Auth, SSRF, and XSS Flaws Disclosed TogetherVypr Intelligence · Aug 25, 2026