CVE-2026-79660 Ech0 before 4.7.3 Email Disclosure via Public API
Unauthenticated attackers can harvest guest commenter email addresses via public API endpoints in Ech0 due to improper JSON serialization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-79660?
CVE-2026-79660 is a medium-severity vulnerability in lin-snow Ech0, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Unauthenticated attackers can harvest all commenter emails by calling the /api/comments and /api/comments/public endpoints without authentication.
Weakness: CWE-200
Which versions are affected by CVE-2026-79660?
3 open source packages ship an affected version, including github.com/lin-snow/Ech0 and github.com/lin-snow/ech0.
| Package | Affected | Fixed in |
|---|---|---|
github.com/lin-snow/Ech0 Go | All versions | 1.4.8-0.20260503034700-cb8d7a997dd8 |
github.com/lin-snow/Ech0 Go | All versions | 1.4.8-0.20260503034700-cb8d7a997dd8 |
github.com/lin-snow/ech0 Go | All versions | 1.4.8-0.20260503034700-cb8d7a997dd8 |
How do I fix CVE-2026-79660?
Upgrade github.com/lin-snow/Ech0 to 1.4.8-0.20260503034700-cb8d7a997dd8 or later.
Is CVE-2026-79660 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-79660 exists.
Sources
Also known as GHSA-845p-52xj-2432, GHSA-rj4g-rqgh-rx9h, GO-2026-5626.