CVE-2026-79666
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Aug 25, 2026
Vendor
unknown
Description
Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data including file paths, stack traces, and internal URLs.