lin-snow Ech0 missing authorization in dashboard log endpoints

Executive brief

Ech0 is a system management dashboard. A security flaw allows any logged-in user, regardless of their permission level, to view sensitive system logs and live activity streams. This could expose internal file paths, administrator activity, and other operational data that could be used to facilitate further attacks on the system.

Technical details

A missing authorization check (CWE-862) exists in the dashboard log endpoints of Ech0. The application registers routes for system logs, SSE log streams, and WebSocket log streams within an authenticated router group but fails to apply admin-only middleware or scope checks. Consequently, any user with a valid JWT can access 'GET /api/system/logs', 'GET /api/system/logs/stream', and 'GET /ws/system/logs'. This allows low-privilege users to retrieve sensitive operational data including stack traces, internal URLs, and background job outputs. The vulnerability is addressed in version 4.3.5 by requiring the 'ScopeAdminSettings' scope on these routes.

Affected products

• lin-snow ech0 < 4.3.5

Timeline

• 2026-04-09: disclosed
• 2026-04-10: advisory: GitHub Advisory published
• 2026-04-10: patched: Version 4.3.5 released

References

• https://github.com/lin-snow/Ech0/security/advisories/GHSA-cp79-9mwr-wr49
• https://github.com/lin-snow/Ech0/releases/tag/v4.3.5
• https://api.github.com/repos/lin-snow/Ech0/security-advisories/GHSA-cp79-9mwr-wr49