Ech0 CVE-2026-79666

Persistent authentication bypass in Ech0 (lin-snow's self-hosted lightweight publishing/memo app) before 4.7.3 lets an a

OAuth redirect URI validation in Ech0 through 4.5.6 allows session hijacking via exchange-code theft by exploiting incom

Denial of service in Ech0 before 5.0.1 allows unauthenticated remote attackers to saturate server CPU by exploiting a qu

Authorization bypass in Ech0 before 4.5.1 allows any authenticated non-admin user to invoke privileged admin endpoints b

Privilege escalation in Ech0 before 4.4.3 allows an attacker holding an admin's profile:read access token to change the

Server-side request forgery in Ech0 before version 4.7.3 allows authenticated users to pivot through the application ser

Scope enforcement in Ech0 4.3.4 and earlier is opt-in at the route level, meaning privileged admin routes that omit the

Scope enforcement bypass in Ech0's comment panel admin API allows any holder of a valid admin-issued access token - rega

Unauthenticated metric inflation in Ech0 before 4.7.3 allows any remote attacker to arbitrarily increment the fav_count

Unauthenticated remote attackers can increment the fav_count of any echo - including private ones - in Ech0 through 4.5.

Ech0 before version 4.7.3 exposes guest commenter email addresses to unauthenticated remote callers via public comment-l

Unsalted MD5 password hashing in Ech0's `MD5Encrypt` function (`internal/util/crypto/crypto.go`) stores credentials in a