CVE-2026-33638
Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint
Summary
Ech0 authenticated user-list exposed data via public /api/allusers endpoint
Original description
The description as published by the source.
Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to version 4.2.0, GET /api/allusers is mounted as a public endpoint and returns user records without authentication. This allows remote unauthenticated user enumeration and exposure of user profile metadata. A fix is available in v4.2.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com