CVE-2026-79666

Ech0 versions before 4.4.3 fail to enforce administrator authorization on dashboard log endpoints. Any authenticated user can query GET /api/system/logs and subscribe to SSE and WebSocket log streams, retrieving sensitive operational data including file paths, stack traces, and internal URLs . Th...

CVE-2026-79666 Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints

Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data...

Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs

Summary Ech0 allows any authenticated user to read historical system logs and subscribe to live log streams because the dashboard log endpoints validate only that a JWT is present and valid, but do not require an administrator role or privileged scope. Impact Any valid user session can access GET...