Is CVE-2026-79666 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-79666?

CVE-2026-79666 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-79666

Description

Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data including file paths, stack traces, and internal URLs.