CVE-2026-79660

Published: Ago 25, 2026 Last Modified: Ago 25, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,9
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM 5,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: none
Availability: none

Description

AI Translation Available

Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Unauthenticated attackers can harvest all commenter emails by calling the /api/comments and /api/comments/public endpoints without authentication.

200

Exposure of Sensitive Information to an Unauthorized Actor

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality
Potential Impacts:
Read Application Data
Applicable Platforms
Technologies: Not Technology-Specific, Web Based, Mobile
Likelihood of Exploit: High
View CWE Details
https://github.com/lin-snow/Ech0/security/advisories/GHSA-r…
https://github.com/lin-snow/Ech0/security/advisories/GHSA-rj4g-rqgh-rx9h
https://www.vulncheck.com/advisories/ech0-before-email-disc…
https://www.vulncheck.com/advisories/ech0-before-email-disclosure-via-public-api