Ech0 CVE-2026-79660

The endpoints /api/comments and /api/comments/public are registered on the unauthenticated PublicRouterGroup with no authentication middleware - no credentials, API keys, or session tokens are required. Default Ech0 installations are affected with no non-default configuration flag or feature toggle required. Exploitation yields email addresses only for users who submitted guest comments, since the submission form requires an email for moderation and reply notifications; the data yield therefore scales with the volume of guest comment activity on the target instance. Exploitation is bounded to Ech0 instances running versions before 4.7.3 that are network-accessible to the attacker - instances not exposed to untrusted networks have reduced but not eliminated exposure.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L) accurately reflects low-complexity, unauthenticated network exploitation with limited confidentiality impact confined to the vulnerable system. A published POC Python script in the GHSA advisory trivializes exploitation - only HTTP access to the target is required. No EPSS score was provided in the input data, and no CISA KEV listing is present, so active exploitation cannot be asserted. Real-world urgency derives less from the raw base score and more from privacy-regulatory exposure: bulk harvesting of guest commenter emails enables phishing, spam campaigns, and potential GDPR or equivalent-jurisdiction violations for any operator collecting EU-resident email addresses. The VC:L rating correctly signals that no credentials, keys, or high-value secrets are exposed, distinguishing this from authentication-bypass or RCE class findings - but the zero-friction unauthenticated mass-enumeration aspect elevates practical urgency beyond what the score alone conveys.

An unauthenticated attacker sends a GET request to /api/echo/page?page=1&pageSize=100 to obtain post UUIDs from the public feed, then iterates through /api/comments?echo_id=<UUID> for each post, collecting all guest commenter email addresses from the JSON responses without supplying any credentials. The GHSA advisory includes a working Python script demonstrating this technique against a default Ech0 installation on port 8300.