# CVE-2026-79669: Ech0 missing authorization on system log endpoints

Source: https://junglewise.ai/threats/cve-2026-79669-ech0-missing-authorization-on-system-log-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-79669 · Severity: medium · CVSS 4.3 · Published 2026-08-25

Ech0 is a logging and monitoring system used to track server activity and application state. A flaw allows any registered user—not just administrators—to read historical system logs and stream real-time logs via multiple endpoints. An attacker can extract sensitive information such as internal file paths, error traces, database details, and user activity, which can be used to plan more sophisticated attacks on the application.

Technologies: [github.com/lin-snow/ech0 (Go)](https://junglewise.ai/threats/technologies/github-com-lin-snow-ech0), [Lin-Snow Ech0](https://junglewise.ai/threats/technologies/ech0). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Lin-Snow](https://junglewise.ai/threats/vendors/lin-snow).

## Quick answers

**Is CVE-2026-79669 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79669 being exploited in the wild.

**How severe is CVE-2026-79669?** Medium severity, with a CVSS score of 4.3, published 25 August 2026.

**Which products and versions are affected?** github.com/lin-snow/ech0 (Go) SEMVER:introduced=0, SEMVER:introduced=0,fixed=4.4.3; Lin-Snow Ech0 before 4.4.3.

**Is there a fix for CVE-2026-79669?** Yes. github.com/lin-snow/ech0 (Go): upgrade to 4.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-79669 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-79669?** Check whether you run github.com/lin-snow/ech0 (Go) or Lin-Snow Ech0 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/lin-snow/ech0 (Go): upgrade to 4.4.3 or later

  ```sh
  go get github.com/lin-snow/ech0@v4.4.3
  ```


## Technical details

This is a missing authorization vulnerability (CWE-862) in the system log endpoints: GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs. The vulnerable code in internal/router/dashboard.go registers these endpoints on the AuthRouterGroup without RequireScopes middleware, and the WSRouterGroup applies no authorization middleware at all. While the endpoints require JWT authentication (any logged-in user), they fail to check whether the user has admin privileges before granting access to sensitive logs. An attacker with a non-admin account can read full historical logs and subscribe to real-time streams, exposing internal file paths, error stack traces, module names, and structured log fields. The fix is to add RequireScopes(ScopeAdminSettings) middleware to all three endpoints, as implemented in patched version 4.4.3.

## Affected products

- lin-snow Ech0 before 4.4.3

## Identifiers

- CVE-2026-79669
- GHSA-w8jj-cwmc-wgq2
- GO-2026-5701

## Timeline

- 2026-08-25: disclosed
- 2026-04-09: patched: Patch released as version 4.4.3

## References

- [https://github.com/lin-snow/Ech0/security/advisories/GHSA-w8jj-cwmc-wgq2](https://github.com/lin-snow/Ech0/security/advisories/GHSA-w8jj-cwmc-wgq2)
- [https://www.vulncheck.com/advisories/ech0-before-missing-authorization-on-system-logs](https://www.vulncheck.com/advisories/ech0-before-missing-authorization-on-system-logs)

## Related threats

- [Ech0 scope bypass in PUT /user endpoint via profile:read token](https://junglewise.ai/threats/cve-2026-79673-ech0-scope-bypass-in-put-user-endpoint-via-profile-read-token)
- [Ech0 authorization bypass in comment panel endpoints](https://junglewise.ai/threats/cve-2026-79672-ech0-authorization-bypass-in-comment-panel-endpoints)
- [Ech0 server-side request forgery in webhook URL validation](https://junglewise.ai/threats/cve-2026-79671-ech0-server-side-request-forgery-in-webhook-url-validation)
- [Ech0 stored cross-site scripting in file upload](https://junglewise.ai/threats/cve-2026-79670-ech0-stored-cross-site-scripting-in-file-upload)
- [Ech0 authentication bypass in like endpoint](https://junglewise.ai/threats/cve-2026-79668-ech0-authentication-bypass-in-like-endpoint)