CVE-2026-33638
Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint
Résumé
Ech0 authenticated user-list exposed data via public /api/allusers endpoint
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to version 4.2.0, GET /api/allusers is mounted as a public endpoint and returns user records without authentication. This allows remote unauthenticated user enumeration and exposure of user profile metadata. A fix is available in v4.2.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com