Security
فارسی
All products

github.com/lin-snow/ech0

Go · Package
18 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup exportCVE-2026-79667 · GHSA-4H9Q-P5J4-XVVHVersion ranges need review. github.com/lin-snow/ech0 Go High Fix reported
Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric InflationCVE-2026-79668 · GHSA-RGJ7-VG8V-J4WRVersion ranges need review. github.com/lin-snow/ech0 Go Medium Fix reported
Ech0 comment model's Email field returned on public /api/comments endpointsCVE-2026-79660 · GHSA-RJ4G-RQGH-RX9H github.com/lin-snow/Ech0github.com/lin-snow/ech0 Go Medium Fix reported
Ech0 has Server-Side Request Forgery (SSRF) via Connect Handler fetchPeerConnectInfoCVE-2026-79659 · GHSA-8MC6-XJPR-H98XVersion ranges need review. github.com/lin-snow/ech0 Go High Fix reported
ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTICVE-2026-79664 · GHSA-FPW6-HRG5-Q5X5 github.com/lin-snow/Ech0github.com/lin-snow/ech0 Go High Fix reported
Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribersCVE-2026-79663 · GHSA-3V85-FQVH-7RXF github.com/lin-snow/Ech0github.com/lin-snow/ech0 Go Medium Fix reported
Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token BypassCVE-2026-79672 · GHSA-FWG7-53P4-G33CVersion ranges need review. github.com/lin-snow/ech0 Go Medium Fix reported
Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted SessionCVE-2026-79673 · GHSA-HM2H-WWWH-G49XVersion ranges need review. github.com/lin-snow/ech0 Go Medium Fix reported
Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File UploadCVE-2026-79670 · GHSA-69HX-63PV-F8F4Version ranges need review. github.com/lin-snow/ech0 Go Medium Fix reported
Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_countCVE-2026-79661 · GHSA-PJ6Q-4VQ4-R8CG github.com/lin-snow/Ech0github.com/lin-snow/ech0 Go Medium Fix reported
Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logsCVE-2026-79666 · GHSA-CP79-9MWR-WR49Version ranges need review. github.com/lin-snow/ech0 Go Medium Fix reported
Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theftCVE-2026-79662 · GHSA-P64J-F4X9-WQ66 github.com/lin-snow/Ech0github.com/lin-snow/ech0 Go High Fix reported
Ech0 has SSRF via DNS Resolution Bypass in Webhook URL ValidationCVE-2026-79671 · GHSA-R2X7-427F-RQ69Version ranges need review. github.com/lin-snow/ech0 Go Medium Fix reported
Ech0's Missing Authorization on System Logs Allows Non-Admin Information DisclosureCVE-2026-79669 · GHSA-W8JJ-CWMC-WGQ2Version ranges need review. github.com/lin-snow/ech0 Go Medium Fix reported
Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.MiddlewareGHSA-MQXV-9RM6-W8QC · GO-2026-5981Version ranges need review. github.com/lin-snow/ech0 Go High No fix reported
Ech0 has Unauthenticated Server-Side Request Forgery in Website Preview FeatureCVE-2026-35036 · GHSA-WC4H-2348-JC3PVersion ranges need review. github.com/lin-snow/ech0 Go High Fix reported
Ech0: Unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadataCVE-2026-35037 · GHSA-CQGF-F4X7-G6WCVersion ranges need review. github.com/lin-snow/ech0 Go High Fix reported
Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint CVE-2026-33638 · GHSA-M983-7426-5HRJVersion ranges need review. github.com/lin-snow/ech0 Go Medium Fix reported