CVE-2026-79669: Ech0 Information Disclosure Vulnerability

CVE-2026-79669 Overview

CVE-2026-79669 is a missing authorization vulnerability [CWE-862] in the Ech0 self-hosted publishing platform before version 4.4.3. The system log endpoints lack authorization checks, allowing any authenticated non-admin user to read and stream server logs. Attackers can query historical logs through GET /api/system/logs, subscribe to real-time streams via GET /api/system/logs/stream, and connect to the WS /ws/system/logs WebSocket. The exposed telemetry includes internal file paths, error stack traces, and application state useful for reconnaissance.

Critical Impact
Any authenticated low-privilege Ech0 user can read historical and real-time server logs, exposing internal paths, stack traces, and application state that support follow-on attacks.

Affected Products

Ech0 self-hosted publishing platform, all versions before 4.4.3
Deployments exposing /api/system/logs and /api/system/logs/stream HTTP endpoints
Deployments exposing the /ws/system/logs WebSocket endpoint

Discovery Timeline

2026-08-25 - CVE-2026-79669 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-79669

Vulnerability Analysis

Ech0 exposes three server log interfaces intended for administrator diagnostics. The route handlers verify that a session is authenticated but do not verify the caller's role. Any account with valid credentials can therefore call the endpoints and receive the full server log output. This grants low-privilege users visibility into activity generated by administrators and other tenants of the instance.

The leaked data can include absolute filesystem paths, database identifiers, request URIs, session or token fragments emitted during errors, and stack traces revealing library versions. This information reduces the effort required for privilege escalation, lateral movement, or targeted exploitation of adjacent components.

Root Cause

The root cause is a missing role check on the system log routes. The handlers for GET /api/system/logs, GET /api/system/logs/stream, and the WS /ws/system/logs upgrade rely solely on authentication middleware. No authorization predicate restricts access to administrator accounts, so the endpoints treat every logged-in user as authorized. This is a classic broken access control pattern captured by CWE-862: Missing Authorization.

Attack Vector

Exploitation requires network access to the Ech0 instance and a valid non-admin account. An attacker registers or reuses a low-privilege user, obtains a session token, and issues an HTTP GET request to /api/system/logs to pull historical entries. Continuous collection is achieved by opening /api/system/logs/stream for server-sent events or by upgrading to the /ws/system/logs WebSocket. Refer to the GitHub Security Advisory GHSA-w8jj-cwmc-wgq2 and the VulnCheck advisory for endpoint details.

Detection Methods for CVE-2026-79669

Indicators of Compromise

Requests to /api/system/logs or /api/system/logs/stream from user sessions that do not belong to administrators.
WebSocket upgrade requests to /ws/system/logs originating from non-admin accounts or unexpected client IP addresses.
Long-lived streaming connections to log endpoints from a single low-privilege account, indicating persistent collection.

Detection Strategies

Correlate the authenticated user role with the accessed route in access logs and flag any non-admin identity that reaches system log paths.
Alert on WebSocket sessions to /ws/system/logs that exceed a short duration threshold or repeat across sessions from the same account.
Track unusual volumes of GET traffic to /api/system/logs outside operational windows.

Monitoring Recommendations

Forward Ech0 reverse-proxy logs to a centralized analytics platform and retain user role fields for authorization audits.
Enable HTTP request logging on the upstream load balancer to preserve full URIs and client identifiers for the log endpoints.
Baseline expected administrator access patterns to the system log APIs and alert on deviations.

How to Mitigate CVE-2026-79669

Immediate Actions Required

Upgrade Ech0 to version 4.4.3 or later, which introduces the missing authorization checks on system log endpoints.
Audit existing user accounts and revoke sessions or tokens issued to untrusted or unnecessary non-admin users.
Review historical access logs for calls to /api/system/logs, /api/system/logs/stream, and /ws/system/logs from non-admin identities.

Patch Information

The maintainers addressed CVE-2026-79669 in Ech0 4.4.3 by enforcing an administrator role check on the system log HTTP and WebSocket routes. Upgrade details are documented in the GitHub Security Advisory GHSA-w8jj-cwmc-wgq2. Instances that cannot be upgraded immediately should apply the compensating controls below.

Workarounds

Block /api/system/logs, /api/system/logs/stream, and /ws/system/logs at the reverse proxy for all clients except administrator source networks.
Restrict Ech0 registration and disable unused low-privilege accounts to reduce the pool of identities that can reach the endpoints.
Place the Ech0 administration surface behind a VPN or IP allowlist until the upgrade to 4.4.3 is deployed.

bash

# Example NGINX snippet restricting Ech0 system log endpoints to an admin CIDR
location ~ ^/(api/system/logs|ws/system/logs) {
    allow 10.10.0.0/24;   # admin network
    deny  all;
    proxy_pass http://ech0_upstream;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}