# github.com/lin-snow/ech0 (Go) vulnerabilities 17 known vulnerabilities (1 critical, 8 high, 8 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.4.7 (May 31, 2025): affected by 17 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 34 since v1.0.0 (May 17, 2025) - Registry: https://pkg.go.dev/github.com/lin-snow/ech0 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-79673: v1.0.0 to v4.4.4-0.20260828062154-22930ec09997+incompatible (through the newest release) - CVE-2026-79672: v1.0.0 to v4.4.4-0.20260828062154-22930ec09997+incompatible (through the newest release) - CVE-2026-79671: v1.0.0 to v4.4.4-0.20260828062154-22930ec09997+incompatible (through the newest release) - CVE-2026-79670: v1.0.0 to v4.4.4-0.20260828062154-22930ec09997+incompatible (through the newest release) - CVE-2026-79669: v1.0.0 to v4.4.4-0.20260828062154-22930ec09997+incompatible (through the newest release) - CVE-2026-79668: v1.0.0 to v1.4.7 (v4.4.4-0.20260828062154-22930ec09997+incompatible is outside it) - CVE-2026-79667: v1.0.0 to v4.4.4-0.20260828062154-22930ec09997+incompatible (through the newest release) - CVE-2026-79666: v1.0.0 to v4.4.4-0.20260828062154-22930ec09997+incompatible (through the newest release) - CVE-2026-79664: v1.0.0 to v1.4.7 (v4.4.4-0.20260828062154-22930ec09997+incompatible is outside it) - CVE-2026-79663: v1.0.0 to v1.4.7 (v4.4.4-0.20260828062154-22930ec09997+incompatible is outside it) - CVE-2026-79662: v1.0.0 to v1.4.7 (v4.4.4-0.20260828062154-22930ec09997+incompatible is outside it) - CVE-2026-79661: v1.0.0 to v1.4.7 (v4.4.4-0.20260828062154-22930ec09997+incompatible is outside it) - CVE-2026-79660: v1.0.0 to v1.4.7 (v4.4.4-0.20260828062154-22930ec09997+incompatible is outside it) - CVE-2026-79659: v1.0.0 to v1.4.7 (v4.4.4-0.20260828062154-22930ec09997+incompatible is outside it) - CVE-2026-35037: v1.0.0 to v1.4.7 (v4.4.4-0.20260828062154-22930ec09997+incompatible is outside it) - CVE-2026-35036: v1.0.0 to v1.4.7 (v4.4.4-0.20260828062154-22930ec09997+incompatible is outside it) - CVE-2026-33638: v1.0.0 to v1.4.7 (v4.4.4-0.20260828062154-22930ec09997+incompatible is outside it) ## Advisories (17) ### [CVE-2026-79673](https://cve.now/CVE-2026-79673): Ech0 before 4.4.3 Scope Bypass via profile:read Token - Severity: High 8.5 - Published: Aug 25, 2026 - Affected: all versions; fixed in 4.4.3. - No fix released. The latest release, v1.4.7, is still affected. ### [CVE-2026-79672](https://cve.now/CVE-2026-79672): Ech0 before 4.4.3 Authentication Bypass via Comment Panel - Severity: High 7.0 - Published: Aug 25, 2026 - Affected: all versions; fixed in 4.4.3. - No fix released. The latest release, v1.4.7, is still affected. ### [CVE-2026-79671](https://cve.now/CVE-2026-79671): Ech0 before 4.4.3 SSRF via DNS Resolution Bypass - Severity: Medium 5.1 - Published: Aug 25, 2026 - Affected: fixed in 4.4.3; all versions. - No fix released. The latest release, v1.4.7, is still affected. ### [CVE-2026-79670](https://cve.now/CVE-2026-79670): Ech0 before 4.4.3 Stored XSS via SVG Upload - Severity: Medium 4.8 - Published: Aug 25, 2026 - Affected: all versions; fixed in 4.4.3. - No fix released. The latest release, v1.4.7, is still affected. ### [CVE-2026-79669](https://cve.now/CVE-2026-79669): Ech0 before 4.4.3 Missing Authorization on System Logs - Severity: Medium 5.3 - Published: Aug 25, 2026 - Affected: fixed in 4.4.3; all versions. - No fix released. The latest release, v1.4.7, is still affected. ### [CVE-2026-79668](https://cve.now/CVE-2026-79668): Ech0 before 4.7.3 Unauthenticated Like Endpoint Metric Inflation - Severity: Medium 6.9 - Published: Aug 25, 2026 - Affected: fixed in 1.4.8-0.20260503040728-a7e8b8e84bd1. - No fix released. The advisory names 1.4.8-0.20260503040728-a7e8b8e84bd1 as the fix, which the registry doesn't have yet. The latest release, v1.4.7, is still affected. ### [CVE-2026-79667](https://cve.now/CVE-2026-79667): Ech0 before 4.4.3 Authentication Bypass via Scope Enforcement - Severity: High 7.2 - Published: Aug 25, 2026 - Affected: all versions; fixed in 4.3.5. - No fix released. The latest release, v1.4.7, is still affected. ### [CVE-2026-79666](https://cve.now/CVE-2026-79666): Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints - Severity: High 7.1 - Published: Aug 25, 2026 - Affected: all versions; fixed in 4.3.5. - No fix released. The latest release, v1.4.7, is still affected. ### [CVE-2026-79664](https://cve.now/CVE-2026-79664): Ech0 before 4.7.3 Access Token Revocation Bypass - Severity: Critical 9.1 - Published: Aug 25, 2026 - Affected: fixed in 1.4.8-0.20260503041146-eab62379c795. - No fix released. The advisory names 1.4.8-0.20260503041146-eab62379c795 as the fix, which the registry doesn't have yet. The latest release, v1.4.7, is still affected. ### [CVE-2026-79663](https://cve.now/CVE-2026-79663): Ech0 before 4.7.3 Stored XSS via RSS feed tag names - Severity: Medium 4.8 - Published: Aug 25, 2026 - Affected: fixed in 1.4.8-0.20260503035519-fd320fe3e902; fixed in 1.4.8-0.20260503035519-fd320fe3e902. - No fix released. The advisory names 1.4.8-0.20260503035519-fd320fe3e902 as the fix, which the registry doesn't have yet. The latest release, v1.4.7, is still affected. ### [CVE-2026-79662](https://cve.now/CVE-2026-79662): Ech0 before 4.7.3 OAuth Redirect URI Validation Bypass - Severity: High 8.8 - Published: Aug 25, 2026 - Affected: fixed in 1.4.8-0.20260503040728-a7e8b8e84bd1; fixed in 1.4.8-0.20260503040728-a7e8b8e84bd1. - No fix released. The advisory names 1.4.8-0.20260503040728-a7e8b8e84bd1 as the fix, which the registry doesn't have yet. The latest release, v1.4.7, is still affected. ### [CVE-2026-79661](https://cve.now/CVE-2026-79661): Ech0 before 4.7.3 Unauthenticated fav\_count Modification - Severity: Medium 6.9 - Published: Aug 25, 2026 - Affected: fixed in 1.4.8-0.20260503035905-cecc2c19b590; fixed in 1.4.8-0.20260503035905-cecc2c19b590. - No fix released. The advisory names 1.4.8-0.20260503035905-cecc2c19b590 as the fix, which the registry doesn't have yet. The latest release, v1.4.7, is still affected. ### [CVE-2026-79660](https://cve.now/CVE-2026-79660): Ech0 before 4.7.3 Email Disclosure via Public API - Severity: Medium 6.9 - Published: Aug 25, 2026 - Affected: fixed in 1.4.8-0.20260503034700-cb8d7a997dd8; fixed in 1.4.8-0.20260503034700-cb8d7a997dd8. - No fix released. The advisory names 1.4.8-0.20260503034700-cb8d7a997dd8 as the fix, which the registry doesn't have yet. The latest release, v1.4.7, is still affected. ### [CVE-2026-79659](https://cve.now/CVE-2026-79659): Ech0 before 4.7.3 Server-Side Request Forgery via fetchPeerConnectInfo - Severity: High 8.3 - Published: Aug 25, 2026 - Affected: fixed in 1.4.8-0.20260503040602-091d26d2d942. - No fix released. The advisory names 1.4.8-0.20260503040602-091d26d2d942 as the fix, which the registry doesn't have yet. The latest release, v1.4.7, is still affected. ### [CVE-2026-35037](https://cve.now/CVE-2026-35037): Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata - Severity: High 7.2 - Published: Apr 6, 2026 - Affected: fixed in 1.4.8-0.20260401031029-4ca56fea5ba4. - No fix released. The advisory names 1.4.8-0.20260401031029-4ca56fea5ba4 as the fix, which the registry doesn't have yet. The latest release, v1.4.7, is still affected. ### [CVE-2026-35036](https://cve.now/CVE-2026-35036): Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature - Severity: High 7.5 - Published: Apr 6, 2026 - Affected: fixed in 1.4.8-0.20260401031029-4ca56fea5ba4. - No fix released. The advisory names 1.4.8-0.20260401031029-4ca56fea5ba4 as the fix, which the registry doesn't have yet. The latest release, v1.4.7, is still affected. ### [CVE-2026-33638](https://cve.now/CVE-2026-33638): Ech0 authenticated user-list exposed data via public \`/api/allusers\` endpoint - Severity: Medium 5.3 - Published: Mar 26, 2026 - Affected: fixed in 1.4.8-0.20260322121226-acbf1fd71011. - No fix released. The advisory names 1.4.8-0.20260322121226-acbf1fd71011 as the fix, which the registry doesn't have yet. The latest release, v1.4.7, is still affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/lin-snow/ech0 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.