cve.bz

CVE-2026-79660

6.9 mediumEPSS 0.4%

Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Unauthenticated attackers can harvest all commenter emails by calling the /api/comments and /api/comments/public endpoints without authentication.

Severity

CVSS 4.0

6.9 medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

5.3 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
CWE
CWE-200
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-rj4g-rqgh-rx9hGogithub.com/lin-snow/Ech0<1.4.8-0.20260503034700-cb8d7a997dd81.4.8-0.20260503034700-cb8d7a997dd8
GO-2026-5626Gogithub.com/lin-snow/ech0<1.4.8-0.20260503034700-cb8d7a997dd81.4.8-0.20260503034700-cb8d7a997dd8

References

Check your stackJSON