CVE-2026-33638: Ech0 Information Disclosure Vulnerability

CVE-2026-33638 Overview

CVE-2026-33638 is a Missing Authorization vulnerability (CWE-862) affecting Ech0, an open-source, self-hosted publishing platform designed for personal idea sharing. Prior to version 4.2.0, the /api/allusers endpoint was mounted as a public route, allowing unauthenticated remote attackers to enumerate all user accounts and access sensitive user profile metadata without any authentication requirements.

Critical Impact
Remote unauthenticated attackers can enumerate all user accounts and harvest user profile metadata, potentially enabling targeted attacks, social engineering campaigns, or further reconnaissance against the Ech0 platform.

Affected Products

Ech0 versions prior to 4.2.0

Discovery Timeline

2026-03-26 - CVE-2026-33638 published to NVD
2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33638

Vulnerability Analysis

This vulnerability stems from a broken access control flaw where the GET /api/allusers endpoint was incorrectly configured as a public route in the application's router configuration. The endpoint returns complete user records including profile metadata without requiring any form of authentication or authorization. This design flaw allows any remote attacker with network access to the Ech0 instance to retrieve the full list of registered users and their associated profile information.

The attack can be executed over the network with low complexity and requires no privileges or user interaction. While the vulnerability does not directly allow modification or deletion of data (integrity and availability are unaffected), it exposes confidential user information to unauthorized parties.

Root Cause

The root cause is a missing authorization check on the /api/allusers API endpoint. In the Go router configuration (internal/router/user.go), the endpoint was mistakenly added to the PublicRouterGroup instead of a protected router group requiring authentication. This allowed the GetAllUsers() handler to be invoked without any credential verification.

Attack Vector

An attacker can exploit this vulnerability by sending a simple HTTP GET request to the /api/allusers endpoint on any exposed Ech0 instance. The attack requires:

Network access to the target Ech0 server
Knowledge of the API endpoint path
No authentication credentials or special privileges

The response contains user records that can be leveraged for user enumeration, credential stuffing attacks, or targeted phishing campaigns.

// Security patch in internal/router/user.go - Removed public access to /allusers endpoint
 	// Public
 	appRouterGroup.PublicRouterGroup.POST("/login", middleware.NoCache(), h.UserHandler.Login())
 	appRouterGroup.PublicRouterGroup.POST("/register", middleware.NoCache(), h.UserHandler.Register())
-	appRouterGroup.PublicRouterGroup.GET("/allusers", h.UserHandler.GetAllUsers())
 	appRouterGroup.PublicRouterGroup.POST(
 		"/passkey/login/begin",
 		middleware.NoCache(),

Source: GitHub Commit Reference

Detection Methods for CVE-2026-33638

Indicators of Compromise

Unusual volume of requests to /api/allusers endpoint from external IP addresses
Requests to /api/allusers without accompanying authentication tokens or session cookies
Multiple rapid sequential requests to the user enumeration endpoint from the same source
Large data transfers in HTTP responses from the /api/allusers path

Detection Strategies

Implement web application firewall (WAF) rules to monitor and alert on unauthenticated access attempts to /api/allusers
Configure API gateway logging to track all requests to user-related endpoints
Deploy network intrusion detection signatures for HTTP GET requests matching the vulnerable endpoint pattern
Review access logs for requests to /api/allusers that lack authentication headers

Monitoring Recommendations

Enable detailed access logging on the Ech0 application server to capture full request metadata
Configure SIEM alerting for anomalous access patterns to user enumeration endpoints
Monitor for reconnaissance activity patterns that may indicate attackers building user lists for future attacks
Establish baseline metrics for API endpoint access and alert on deviations

How to Mitigate CVE-2026-33638

Immediate Actions Required

Upgrade Ech0 to version 4.2.0 or later immediately
If immediate upgrade is not possible, implement network-level access controls to restrict access to the Ech0 instance
Review access logs for evidence of prior exploitation attempts
Consider notifying users if unauthorized access to user data is suspected

Patch Information

The vulnerability has been fixed in Ech0 version 4.2.0. The patch removes the /allusers endpoint from the public router group, requiring proper authentication before user records can be accessed.

Fixed Version:4.2.0
Patch Commit:acbf1fd71011e6b9e1e6a911128056a19862f681
Release Notes:GitHub Release v4.2.0
Security Advisory:GHSA-m983-7426-5hrj

Workarounds

Deploy a reverse proxy (nginx, Apache) in front of Ech0 with rules blocking unauthenticated access to /api/allusers
Implement IP allowlisting to restrict access to the Ech0 instance to trusted networks only
Use network segmentation to limit exposure of the vulnerable endpoint to internal networks

bash

# nginx configuration example to block access to vulnerable endpoint
location /api/allusers {
    deny all;
    return 403;
}