Ech0 EUVD-2026-65445

Exploitation requires a valid authenticated session on the target Ech0 instance - any account, including one created via the public registration endpoint, satisfies this requirement since non-admin users are provisioned with IsAdmin: false and IsOwner: false. No special configuration, non-default deployment mode, or elevated privilege is needed beyond basic authentication. The WebSocket endpoint (WS /ws/system/logs) has a marginally lower bar than the HTTP endpoints because WSRouterGroup carries no middleware; only ParseToken validation inside the handler is applied. What limits exploitation is the requirement for a valid JWT: unauthenticated external actors cannot reach the endpoints. Instances with user registration disabled and no compromised credentials are not reachable by external attackers through this specific vector.

The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L) accurately captures the real-world risk profile: network-reachable, low complexity, but requiring a valid authenticated session, with only partial confidentiality impact. The vulnerability is not in CISA KEV and no public exploit code is known, limiting immediate opportunistic exploitation. The primary risk is reconnaissance: exposed stack traces, internal file paths, and module names lower the barrier for targeted follow-on attacks against the same instance. No EPSS score was provided in the input data - exploitation probability cannot be quantified from available signals. The WebSocket endpoint (WSRouterGroup) is notably broader in exposure than the HTTP endpoints because it has no middleware at all, relying solely on ParseToken called inside the handler; this means the authorization gap is technically wider for the WS path. Overall, this is a real and easily triggered vulnerability for any registered non-admin user, but its impact ceiling is information disclosure rather than direct system compromise.

An attacker who registers a non-admin account on an Ech0 instance - or who compromises any low-privilege credential - authenticates to obtain a valid JWT, then issues a GET request to /api/system/logs or connects to the WebSocket endpoint WS /ws/system/logs. The server returns a stream of structured log entries containing internal Go file paths (caller field), module names, error messages, and application state, which the attacker uses to map the internal codebase structure and identify error-prone modules for targeted follow-on exploitation. No public proof-of-concept code is required; the attack is straightforward HTTP/WebSocket interaction with a valid session token.