CVE-2026-33638: Ech0 Information Disclosure Vulnerability

CVE-2026-33638 Overview

CVE-2026-33638 is a Missing Authorization vulnerability (CWE-862) affecting Ech0, an open-source, self-hosted publishing platform designed for personal idea sharing. Prior to version 4.2.0, the /api/allusers endpoint was mounted as a public route, allowing unauthenticated remote attackers to enumerate all user accounts and access sensitive user profile metadata without any authentication requirements.

Critical Impact

Remote unauthenticated attackers can enumerate all user accounts and harvest user profile metadata, potentially enabling targeted attacks, social engineering campaigns, or further reconnaissance against the Ech0 platform.

Affected Products

• Ech0 versions prior to 4.2.0

Discovery Timeline

• 2026-03-26 - CVE-2026-33638 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33638

Vulnerability Analysis

This vulnerability stems from a broken access control flaw where the GET /api/allusers endpoint was incorrectly configured as a public route in the application's router configuration. The endpoint returns complete user records including profile metadata without requiring any form of authentication or authorization. This design flaw allows any remote attacker with network access to the Ech0 instance to retrieve the full list of registered users and their associated profile information.

The attack can be executed over the network with low complexity and requires no privileges or user interaction. While the vulnerability does not directly allow modification or deletion of data (integrity and availability are unaffected), it exposes confidential user information to unauthorized parties.

Root Cause

The root cause is a missing authorization check on the /api/allusers API endpoint. In the Go router configuration (internal/router/user.go), the endpoint was mistakenly added to the PublicRouterGroup instead of a protected router group requiring authentication. This allowed the GetAllUsers() handler to be invoked without any credential verification.

Attack Vector

An attacker can exploit this vulnerability by sending a simple HTTP GET request to the /api/allusers endpoint on any exposed Ech0 instance. The attack requires:

1. Network access to the target Ech0 server
2. Knowledge of the API endpoint path
3. No authentication credentials or special privileges

The response contains user records that can be leveraged for user enumeration, credential stuffing attacks, or targeted phishing campaigns.

// Security patch in internal/router/user.go - Removed public access to /allusers endpoint
 	// Public
 	appRouterGroup.PublicRouterGroup.POST("/login", middleware.NoCache(), h.UserHandler.Login())
 	appRouterGroup.PublicRouterGroup.POST("/register", middleware.NoCache(), h.UserHandler.Register())
-	appRouterGroup.PublicRouterGroup.GET("/allusers", h.UserHandler.GetAllUsers())
 	appRouterGroup.PublicRouterGroup.POST(
 		"/passkey/login/begin",
 		middleware.NoCache(),

Source: GitHub Commit Reference

Detection Methods for CVE-2026-33638

Indicators of Compromise

• Unusual volume of requests to /api/allusers endpoint from external IP addresses
• Requests to /api/allusers without accompanying authentication tokens or session cookies
• Multiple rapid sequential requests to the user enumeration endpoint from the same source
• Large data transfers in HTTP responses from the /api/allusers path

Detection Strategies

• Implement web application firewall (WAF) rules to monitor and alert on unauthenticated access attempts to /api/allusers
• Configure API gateway logging to track all requests to user-related endpoints
• Deploy network intrusion detection signatures for HTTP GET requests matching the vulnerable endpoint pattern
• Review access logs for requests to /api/allusers that lack authentication headers

Monitoring Recommendations

• Enable detailed access logging on the Ech0 application server to capture full request metadata
• Configure SIEM alerting for anomalous access patterns to user enumeration endpoints
• Monitor for reconnaissance activity patterns that may indicate attackers building user lists for future attacks
• Establish baseline metrics for API endpoint access and alert on deviations

How to Mitigate CVE-2026-33638

Immediate Actions Required

• Upgrade Ech0 to version 4.2.0 or later immediately
• If immediate upgrade is not possible, implement network-level access controls to restrict access to the Ech0 instance
• Review access logs for evidence of prior exploitation attempts
• Consider notifying users if unauthorized access to user data is suspected

Patch Information

The vulnerability has been fixed in Ech0 version 4.2.0. The patch removes the /allusers endpoint from the public router group, requiring proper authentication before user records can be accessed.

• Fixed Version:4.2.0
• Patch Commit:acbf1fd71011e6b9e1e6a911128056a19862f681
• Release Notes:GitHub Release v4.2.0
• Security Advisory:GHSA-m983-7426-5hrj

Workarounds

• Deploy a reverse proxy (nginx, Apache) in front of Ech0 with rules blocking unauthenticated access to /api/allusers
• Implement IP allowlisting to restrict access to the Ech0 instance to trusted networks only
• Use network segmentation to limit exposure of the vulnerable endpoint to internal networks

# nginx configuration example to block access to vulnerable endpoint
location /api/allusers {
    deny all;
    return 403;
}