CVE-2026-33638
Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint
概要
Ech0 authenticated user-list exposed data via public /api/allusers endpoint
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to version 4.2.0, GET /api/allusers is mounted as a public endpoint and returns user records without authentication. This allows remote unauthenticated user enumeration and exposure of user profile metadata. A fix is available in v4.2.0.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com