Ech0 CVE-2026-79666

Exploitation requires a valid user account on the Ech0 instance - any JWT-bearing authenticated session is sufficient regardless of privilege level; no administrator role or elevated scope is needed. The three affected endpoints are GET /api/system/logs (historical log retrieval), GET /api/system/logs/stream (SSE live stream, accepts token as query parameter), and GET /ws/system/logs (WebSocket live stream). Unauthenticated users cannot exploit this vulnerability because the AuthRouterGroup enforces JWT validation - the flaw is specifically the absence of the additional admin-role check after authentication succeeds. Exploitation is further limited to deployments where non-administrative user accounts are provisioned: single-user installations or deployments restricted to administrators only have no meaningful additional trust boundary to cross. No special configuration, non-default settings, specific platform, or particular deployment mode is required beyond the presence of active non-admin user accounts.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) accurately characterizes the risk: remotely exploitable with low complexity by any authenticated user, yielding high confidentiality impact with no integrity or availability consequences. The CVSS 4.0 score of 7.1 is consistent with this profile. No EPSS score was supplied in the source intelligence, so probabilistic exploitation frequency cannot be quantified. The CVE is not listed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, indicating opportunistic mass exploitation is not currently observed. The realistic risk is constrained by the requirement for a valid user account - exploitation is purely post-authentication - and by Ech0's niche deployment footprint as a self-hosted Go application. However, for any multi-user deployment where non-administrative accounts are provisioned, this flaw collapses the privilege boundary between regular users and administrators with respect to operational log data, and the harvested intelligence (internal URLs, stack traces, file paths) can materially reduce the effort required for follow-on attacks. Treating this as a low-urgency but genuine remediation priority is appropriate for affected deployments.

An authenticated low-privilege user with a valid Ech0 account issues a GET request to /api/system/logs with their JWT token and receives recent system log entries containing internal file paths and stack traces. The attacker then subscribes to the SSE stream at /api/system/logs/stream to monitor live application activity, using harvested internal URLs and path information to map the backend infrastructure and identify targets for follow-on exploitation. No public exploit code is required; standard HTTP tooling is sufficient given the straightforward nature of the authorization gap.