lin-snow Ech0 missing authorization in system log endpoints

Executive brief

Ech0 is a Go-based application. A vulnerability in its dashboard allows any registered user, even those without administrative privileges, to view and stream live system logs. These logs can contain sensitive information such as internal file paths, database errors, and details about other users' activities, which could be used to plan more advanced attacks.

Technical details

The system log endpoints (GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs) fail to implement authorization checks. While they are protected by JWT authentication, they lack the 'RequireScopes' middleware used elsewhere in the application to enforce administrative privileges. This allows any user with a valid JWT—regardless of their 'IsAdmin' status—to access historical logs and real-time streams via SSE or WebSockets. The exposed LogEntry structures include sensitive metadata such as internal file paths (caller), error stack traces, and module names. The vulnerability is addressed in version 4.4.3 by adding the necessary scope-based middleware to the dashboard routes.

Affected products

• lin-snow ech0 < 4.4.3

Timeline

• 2026-04-09: patched: Version 4.4.3 released
• 2026-04-10: advisory

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D