CVE-2026-79666: Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints
Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data including file paths, stack traces, and internal URLs.
Affected Software
Event History
Frequently Asked Questions
Who can exploit the exposed log endpoints?
Any authenticated Ech0 user can exploit them; administrator privileges are not required. The attacker needs a valid user session and can access the endpoints remotely.
Which interfaces can expose log data?
Affected users can query GET /api/system/logs and subscribe to the server-sent event (SSE) and WebSocket log streams. These interfaces can disclose operational details such as file paths, stack traces, and internal URLs.
What versions are affected?
Ech0 versions before 4.4.3 are affected. Upgrading to 4.4.3 or later addresses the missing administrator authorization described for these dashboard log endpoints.