Read the docs
TI-2026-26019 Aliases CVE-2026-33638GHSA-m983-7426-5hrj

Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint

Priority MEDIUM 63CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to version 4.2.0, `GET /api/allusers` is mounted as a public endpoint and returns user records without authentication. This allows remote unauthenticated user enumeration and exposure of user profile metadata. A fix is available in v4.2.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00503 43rd percentileScored 2026-11-07
Fix Fixed Ech0 (lin-snow): 4.2.0github.com/lin-snow/ech0 (Go): 1.4.8-0.20260322121226-acbf1fd71011

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
lin-snowEch0before 4.2.04.2.0Patch availableCNA
—github.com/lin-snow/ech0 (Go)before 1.4.8-0.20260322121226-acbf1fd710111.4.8-0.20260322121226-acbf1fd71011Patch availableGHSA-m983-7426-5hrj
  • Ech0 Vendorlin-snow Affected before 4.2.0 Fixed in 4.2.0 Patch available CNA
  • github.com/lin-snow/ech0 (Go) Vendor— Affected before 1.4.8-0.20260322121226-acbf1fd71011 Fixed in 1.4.8-0.20260322121226-acbf1fd71011 Patch available GHSA-m983-7426-5hrj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ech0:ech0:*:*:*:*:*:*:*:*before 4.2.0Vulnerablelin-snow
  • cpe:2.3:a:ech0:ech0:*:*:*:*:*:*:*:* Versions before 4.2.0 Vulnerable ·lin-snow

Remediation

  • Fix · CNA Ech0 (lin-snow) Fixed in 4.2.0
  • Fix · GHSA-m983-7426-5hrj github.com/lin-snow/ech0 (Go) Fixed in 1.4.8-0.20260322121226-acbf1fd71011 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33638
  2. 2026-10-03 Alias added: GHSA-m983-7426-5hrj
  3. 2026-10-24 EPSS moved to the 50th–90th percentile
  4. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 1

Advisory 2

Other 2

  • TI-2026-27239 Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature CVSS 3.1HIGH 7.5
  • TI-2026-27240 Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences