CVE-2026-79660: Exposure of Sensitive Information to an Unauthorized Actor in lin-snow Ech0

CVE-2026-79660 affects lin-snow Ech0 versions before 4.7.3. The issue arises from improper JSON serialization tags on the Comment model, which causes guest commenter email addresses to be exposed through the public API endpoints /api/comments and /api/comments/public. Because these endpoints do not require authentication, unauthenticated attackers can retrieve all commenter emails by making calls to these endpoints. This exposure of sensitive information constitutes an information disclosure vulnerability.

The vulnerability allows unauthenticated attackers to harvest email addresses of guest commenters, potentially leading to privacy violations and enabling further targeted attacks such as phishing. There is no indication of code execution or system compromise, but the exposure of sensitive user information is significant.

Upgrade Ech0 to version 4.7.3 or later, where this issue has been fixed. Versions before 4.7.3 are vulnerable due to improper JSON serialization. No vendor advisory or patch link is provided in the data, but the version boundary indicates that 4.7.3 contains the fix.