CVE-2026-79669: Missing Authorization in lin-snow Ech0

Ech0 versions prior to 4.4.3 have a missing authorization check vulnerability on system log endpoints. Authenticated users without administrative privileges can read and stream server logs through GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs endpoints. This unauthorized access enables attackers to gather reconnaissance data including internal file paths, error stack traces, and application state information, potentially aiding further attacks.

The vulnerability allows unauthorized access to sensitive server logs by any authenticated non-admin user. Exposure of internal file paths, error stack traces, and application state can facilitate reconnaissance and potentially aid attackers in crafting more targeted attacks. However, there is no indication of privilege escalation or direct code execution from this vulnerability alone.

Upgrade Ech0 to version 4.4.3 or later, where authorization checks on system log endpoints have been implemented. Patch status is confirmed by the version range affected and fixed in 4.4.3. No vendor advisory content was provided, so check the vendor's official channels for confirmation and further guidance.