CVE-2026-33638

MEDIUM

Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint

Title source: cna

Description

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to version 4.2.0, `GET /api/allusers` is mounted as a public endpoint and returns user records without authentication. This allows remote unauthenticated user enumeration and exposure of user profile metadata. A fix is available in v4.2.0.

References (3)

[X_Refsource_Confirm] https://github.com/lin-snow/Ech0/security/advisories/GHSA-m983-7426-5hrj

[X_Refsource_Misc] https://github.com/lin-snow/Ech0/commit/acbf1fd71011e6b9e1e6a911128056a19862f681

View Writeup ZIP pw:eip

[X_Refsource_Misc] https://github.com/lin-snow/Ech0/releases/tag/v4.2.0

Scores

CVSS v3 5.3

EPSS 0.0003

EPSS Percentile 10.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (3)

ech0/ech0 < 4.2.0

lin-snow/ech0 0 - 1.4.8-0.20260322121226-acbf1fd71011Go

lin-snow/Ech0 < 4.2.0

Published Mar 26, 2026

Tracked Since Mar 27, 2026