CVE-2026-79669 Ech0 before 4.4.3 Missing Authorization on System Logs
Authenticated non-admin users can access system logs via API endpoints, exposing sensitive internal data and application state.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-79669?
CVE-2026-79669 is a medium-severity missing authorization vulnerability in lin-snow Ech0, published on 25 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather reconnaissance data including internal file paths, error stack traces, and application state.
Weakness: CWE-862
Which versions are affected by CVE-2026-79669?
3 open source packages ship an affected version, including github.com/lin-snow/ech0.
| Package | Affected | Fixed in |
|---|---|---|
github.com/lin-snow/ech0 Go | All versions | None |
github.com/lin-snow/ech0 Go | All versions | 4.4.3 |
github.com/lin-snow/ech0 Go | All versions | 4.4.3 |
How do I fix CVE-2026-79669?
Upgrade github.com/lin-snow/ech0 to 4.4.3 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-79669 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-79669 exists.
Sources
Also known as GHSA-vw9j-c9ff-mwf8, GHSA-w8jj-cwmc-wgq2, GO-2026-5701.