Ech0 Unauthorized Log Access Before 4.4.3

Executive Summary

CVE-2026-79669 is a missing authorization vulnerability in Ech0 versions before 4.4.3. It allows any authenticated non-admin user to read and stream all server logs through endpoints like GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs without proper checks.

Useful 0 Not Useful 0

Detection Guidance

Check if your Ech0 instance is running a vulnerable version (<4.4.3) by inspecting the version in logs or configuration files. Test access to the vulnerable endpoints using curl commands like: curl -X GET http://<target>/api/system/logs, curl -X GET http://<target>/api/system/logs/stream, or connect via WebSocket to ws://<target>/ws/system/logs. If these return logs without admin privileges, the system is vulnerable.

Monitor network traffic for unauthorized access attempts to these endpoints. Review server logs for unusual GET or WS requests to /api/system/logs, /api/system/logs/stream, or /ws/system/logs from non-admin users.

Useful 0 Not Useful 0

Impact Analysis

Attackers can access sensitive data in logs such as internal file paths, error stack traces, and application state. This information can be used for further attacks, including reconnaissance and exploiting other vulnerabilities.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthorized access to sensitive system logs containing internal file paths, error stack traces, and application state. This could expose personally identifiable information (PII) or protected health information (PHI), violating GDPR and HIPAA compliance requirements for data protection and access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Ech0 to version 4.4.3 or later immediately. If upgrading is not possible, restrict access to the vulnerable endpoints by updating firewall rules or network policies to block external and non-admin internal access to /api/system/logs, /api/system/logs/stream, and /ws/system/logs.

Apply role-based access control to enforce admin-only access to these endpoints. Review and update middleware in the Ech0 application to require admin scopes for log endpoints, as described in the GitHub advisory.

Useful 0 Not Useful 0