CVE-2026-79660: Ech0 Information Disclosure Vulnerability

CVE-2026-79660 Overview

CVE-2026-79660 is an information disclosure vulnerability affecting Ech0 versions prior to 4.7.3. The flaw stems from improper JSON serialization tags on the Comment model, which causes guest commenter email addresses to be included in responses from public API endpoints. Unauthenticated attackers can call /api/comments and /api/comments/public to harvest every commenter email address stored by the application. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can enumerate all guest commenter email addresses from affected Ech0 instances, enabling targeted phishing and privacy violations.

Affected Products

Ech0 versions before 4.7.3
/api/comments endpoint (unauthenticated)
/api/comments/public endpoint (unauthenticated)

Discovery Timeline

2026-08-25 - CVE-2026-79660 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-79660

Vulnerability Analysis

Ech0 is a self-hosted lightweight publishing platform. The application exposes public API endpoints that return comment data for rendering on posts. In versions before 4.7.3, the Comment struct used for serialization does not restrict which fields are marshaled into public JSON responses. As a result, the email field submitted by guest commenters is returned alongside intended public fields such as author name and comment body.

Any unauthenticated client can enumerate this data by issuing simple HTTP GET requests to /api/comments or /api/comments/public. Because the endpoints require no authentication, attackers can automate collection at scale and correlate email addresses with the associated site content and commenter identities.

Root Cause

The root cause is missing or incorrect JSON serialization tags on the Comment model. In Go, struct fields without an explicit json:"-" directive are marshaled by default when returned through json.Marshal. The email field, intended for administrative use and notification workflows, was not tagged to be excluded from serialization when responses are sent to unauthenticated API consumers.

Attack Vector

Exploitation requires no authentication, no user interaction, and no elevated privileges. An attacker sends an HTTP GET request to the vulnerable endpoints on any reachable Ech0 instance. The response body contains a JSON array of comment objects with the email field populated for each guest commenter. Attackers can page through results or scrape historical comments to build a complete list of exposed addresses.

See the GitHub Security Advisory and the VulnCheck Security Advisory for maintainer-confirmed technical details.

Detection Methods for CVE-2026-79660

Indicators of Compromise

Repeated unauthenticated GET requests to /api/comments or /api/comments/public from a single source IP
Web server access logs showing enumeration patterns such as sequential pagination parameters against comment endpoints
Elevated outbound response sizes from the comment API relative to baseline traffic

Detection Strategies

Inspect HTTP response bodies from /api/comments and /api/comments/public for the presence of an email field
Correlate anomalous scraping User-Agent strings and non-browser clients querying comment APIs
Alert on high-volume, low-diversity access to comment endpoints originating from cloud provider or VPN ranges

Monitoring Recommendations

Enable request logging for all /api/comments* routes and forward logs to a centralized analytics platform
Establish a baseline of expected request rates to comment endpoints and alert on deviations
Track distinct source IPs querying comment endpoints per hour to identify harvesting activity

How to Mitigate CVE-2026-79660

Immediate Actions Required

Upgrade Ech0 to version 4.7.3 or later, which corrects the serialization tags on the Comment model
Audit historical web server logs for unauthenticated access to /api/comments and /api/comments/public
Notify affected guest commenters if evidence of harvesting is identified

Patch Information

The maintainer released a fix in Ech0 4.7.3 that adjusts JSON serialization on the Comment model so that guest email addresses are excluded from responses on public API routes. Refer to the GitHub Security Advisory GHSA-rj4g-rqgh-rx9h for the patch commit and upgrade guidance.

Workarounds

Place the Ech0 instance behind an authenticating reverse proxy that blocks unauthenticated access to /api/comments and /api/comments/public until the upgrade is applied
Apply web application firewall rules that strip the email field from JSON responses returned by comment endpoints
Temporarily disable guest commenting to prevent additional email addresses from being stored while remediation is pending

bash

# Example NGINX rule to block unauthenticated access to affected endpoints
location ~ ^/api/comments(/public)?$ {
    if ($http_authorization = "") {
        return 403;
    }
    proxy_pass http://ech0_backend;
}