CVE-2026-79669: Ech0 before 4.4.3 Missing Authorization on System Logs
Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather reconnaissance data including internal file paths, error stack traces, and application state.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Ech0 user who is not an administrator can access the affected system-log endpoints. The attacker only needs a valid non-admin account and network access to the application.
Which interfaces expose the logs?
Historical logs are available through GET /api/system/logs. Real-time logs can be accessed through GET /api/system/logs/stream and the WebSocket endpoint /ws/system/logs.
What information could be exposed through the logs?
The exposed historical and live logs may reveal reconnaissance information, including internal file paths, error stack traces, and application state.
Which versions are affected?
Ech0 versions before 4.4.3 are affected. Upgrading to 4.4.3 or later addresses the missing authorization checks.