These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
Ech0 before 4.4.3 has a vulnerability in the PUT /user endpoint, protected by the read-only profile:read scope, allowing an attacker with an admin's profile:read access token to change the admin's password and obtain an unrestricted session token. This issue affects administrators and users of Ech0 versions prior to 4.4.3, as well as security teams responsible for monitoring and protecting against potenti [truncated]
CVE-2026-79671 is a server-side request forgery (SSRF) vulnerability in Ech0 before version 4.4.3. The vulnerability exists in the validateWebhookURL function, which fails to properly validate hostnames that DNS-resolve to private or internal IPs. An attacker with admin privileges can exploit this by creating a webhook with a malicious hostname, potentially leading to unauthorized requests to internal ser [truncated]
Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only client-supplied headers without server-side inspection. Attackers with admin privileges can upload SVG or HTML files containing JavaScript that executes in the application origin when accessed by any user, enabling session hijacking and data exfiltration. This vulnerabi [truncated]
CVE-2026-79669 debrief based on CVE Program and NVD records. Ech0 before 4.4.3 has a vulnerability allowing any authenticated non-admin user to read and stream all server logs, potentially exposing sensitive information. Defenders should assess exposure and prioritize mitigation, especially in publicly accessible systems. This vulnerability enables attackers to gather reconnaissance data, including intern [truncated]
Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint. This allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting, compromising the integrity of engagement metrics and social ranking systems. The CVE record was published on 2026-08-25T12:16:34.967Z and has not been modified since then. Affected use [truncated]
Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token (least-privilege) restrictions on several privileged admin routes. Multiple privileged endpoints (e.g., /api/inbox, /api/panel/comments, /api/backup/export) omit scope checks and authorize based only on the user's admin role, and the backup export handler discards token scope metadata entirely. An attacker holding a deliberately [truncated]
CVE-2026-79666 is a HIGH-severity vulnerability in Ech0 before 4.4.3, allowing any authenticated user to access system logs via GET /api/system/logs and subscribe to SSE and WebSocket log streams. This potentially exposes sensitive operational data including file paths, stack traces, and internal URLs. The vulnerability has a CVSS score of 7.1. To mitigate, administrators should review and update Ech0 to [truncated]
The Ech0 application prior to version 4.5.1 contains an authorization bypass vulnerability in the RequireScopes middleware. This vulnerability allows logged-in non-admin users to access admin endpoints by sending authenticated session tokens to unprotected endpoints. The vulnerability impacts Ech0 deployments, enabling unauthorized access to sensitive information such as system logs, visitor statistics, a [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-25T12:16:33.627Z and has not been modified since then. CVE-2026-79663 is a stored cross-site scripting vulnerability in Ech0 before version 4.7.3. The vulnerability exists in the public RSS feed where tag names and markdown content are rendered without HTML escaping. Attackers with admin privileges [truncated]
The CVE-2026-79662 vulnerability in Ech0 allows an attacker to craft a redirect URI that can leak a one-time exchange code, potentially leading to unauthorized access. This OAuth redirect URI validation vulnerability occurs in the parseAndValidateClientRedirect function, which only compares the scheme and host of the client-supplied redirect_uri against the admin-configured allowlist, ignoring path, query [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-25T12:16:29.870Z and has not been modified since then. CVE-2026-79661 is a medium-severity vulnerability in Ech0 versions through 4.5.6. The PUT /api/echo/like/:id endpoint is registered on the public router group without authentication or rate limiting, allowing attackers to increment fav_count cou [truncated]
CVE-2026-79660 is a MEDIUM-rated vulnerability in Ech0 versions before 4.7.3. The issue arises from improper JSON serialization tags on the Comment model, allowing unauthenticated attackers to harvest commenter email addresses by calling /api/comments and /api/comments/public endpoints. This vulnerability has a CVSS score of 6.9. Affected users should update to the latest version to prevent unauthorized a [truncated]
CVE-2026-79664 debrief: Ech0 access token revocation bypass allows perpetual authenticated access. The vulnerability in Ech0 before 4.7.3 allows attackers to maintain perpetual authenticated access after token theft due to a failure in properly revoking access tokens created with the never-expire option. This issue arises from three independent revocation mechanisms failing: logout panics on a nil Expires [truncated]
CVE-2026-79659 is a high-severity vulnerability in the Ech0 product from lin-snow. An authenticated attacker can exploit this server-side request forgery vulnerability to access internal services and cloud metadata endpoints. The vulnerability exists in the fetchPeerConnectInfo function, which uses unvalidated HTTP requests. This issue allows attackers to supply arbitrary URLs, potentially leading to unau [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-25T12:16:29.123Z and has not been modified since then. Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. This vulnerability can lead to denial of service attacks with large, specially crafted he [truncated]