Ech0 API Email Exposure via Improper JSON Serialization

Executive Summary

CVE-2026-79660 affects Ech0 versions before 4.7.3. It allows unauthenticated attackers to access guest commenter email addresses through public API endpoints like /api/comments and /api/comments/public. This happens because the Comment model's Email field is improperly serialized in API responses while sensitive fields like IPHash are correctly excluded.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if unauthenticated requests to /api/comments or /api/comments/public return email addresses in the response. Use curl commands like: curl -s http://<target>/api/comments | grep -i email or curl -s http://<target>/api/comments/public | grep -i email. If emails are exposed, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

Attackers can harvest all guest commenter email addresses without authentication. This exposes private user data, enabling spam, phishing attacks, or cross-instance aggregation. Users may face privacy violations if their email addresses are misused.

Useful 0 Not Useful 0

Compliance Impact

The exposure of email addresses may violate privacy regulations like GDPR and CCPA, as these emails are considered private user data. Organizations using vulnerable Ech0 versions could face compliance penalties for failing to protect sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Update Ech0 to version 4.7.3 or later. If an update is not immediately possible, modify the Comment model to exclude the Email field from API responses by changing its JSON tag to json:"-" or implement a PublicComment DTO to filter sensitive data.

Useful 0 Not Useful 0