CVE-2026-79660: Ech0 before 4.7.3 Email Disclosure via Public API
Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Unauthenticated attackers can harvest all commenter emails by calling the /api/comments and /api/comments/public endpoints without authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ech0to a version that resolves this vulnerability.Fixed in 4.7.3 - Compensating control
Restrict access to the /api/comments and /api/comments/public endpoints so unauthenticated users cannot call them to harvest guest commenter email addresses.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote user who can reach the Ech0 public API endpoints can exploit it. No account, privileges, or user interaction are required.
Which endpoints expose the email addresses?
The affected public endpoints are /api/comments and /api/comments/public. They can disclose guest commenter email addresses.
How can I tell whether an instance is affected?
An Ech0 instance is affected if it is running a version before 4.7.3 and its public API endpoints are reachable. Requesting the affected comment endpoints without authentication can confirm whether guest commenter email fields are returned.
What should be done if patching cannot happen immediately?
Restrict unauthenticated access to /api/comments and /api/comments/public until the instance can be upgraded. This prevents public harvesting of commenter email addresses through those endpoints.