Security advisories

high2026-07-14

Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware

GHSA-mqxv-9rm6-w8qc

high2026-05-07

ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI

GHSA-fpw6-hrg5-q5x5

high2026-05-07

Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theft

GHSA-p64j-f4x9-wq66

high2026-05-07

Ech0 has Server-Side Request Forgery (SSRF) via Connect Handler fetchPeerConnectInfo

GHSA-8mc6-xjpr-h98x

medium2026-05-07

Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_count

GHSA-pj6q-4vq4-r8cg

medium2026-05-07

Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation

GHSA-rgj7-vg8v-j4wr

medium2026-05-07

Ech0's RSS feed renders unescaped tag names and raw-HTML markdown, stored XSS against subscribers

GHSA-3v85-fqvh-7rxf

medium2026-05-07

Ech0 comment model's Email field returned on public /api/comments endpoints

GHSA-rj4g-rqgh-rx9h

medium2026-04-10

Ech0 has Stored XSS via SVG Upload and Content-Type Validation Bypass in File Upload

GHSA-69hx-63pv-f8f4

medium2026-04-10

Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation

GHSA-r2x7-427f-rq69

medium2026-04-10

Ech0's Missing Authorization on System Logs Allows Non-Admin Information Disclosure

GHSA-w8jj-cwmc-wgq2

medium2026-04-10

Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass

GHSA-fwg7-53p4-g33c

medium2026-04-10

Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session

GHSA-hm2h-wwwh-g49x

medium2026-04-10

Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs

GHSA-cp79-9mwr-wr49

high2026-04-10

Ech0: Scoped admin access tokens can bypass least-privilege controls on privileged endpoints, including backup export

GHSA-4h9q-p5j4-xvvh

high2026-04-03

Ech0: Unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata

GHSA-cqgf-f4x7-g6wc · CVE-2026-35037

high2026-04-03

Ech0 has Unauthenticated Server-Side Request Forgery in Website Preview Feature

GHSA-wc4h-2348-jc3p · CVE-2026-35036

medium2026-03-24

Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint

GHSA-m983-7426-5hrj · CVE-2026-33638