Threats affecting pkg:github/lin-snow/Ech0

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, the GET /api/website/title endpoint accepts an arbitrary URL via the website_url query parameter and makes a server-side HTTP request to it without any validation of the target host or IP address. The endpoint requires no authentication. An attacker can use this to reach internal network services, cloud metadata endpoints (169.254.169.254), and localhost-bound services, with partial response data exfiltrated via the HTML <title> tag extraction This vulnerability is fixed in 4.2.8.

CVE-2026-35036 is a Server-Side Request Forgery (SSRF) vulnerability in lin-snow Ech0 versions prior to 4.2.8. The vulnerability exists in the unauthenticated GET /api/website/title endpoint, which fetches page titles for link previews. This endpoint accepts attacker-controlled URLs without any host allowlist or SSRF filtering and uses an HTTP client configured with InsecureSkipVerify: true. An attacker able to reach the instance can make the server perform arbitrary HTTP/HTTPS requests from its network perspective. The issue is fixed in Ech0 version 4.2.8.

CVE-2026-33638 is a medium severity vulnerability in lin-snow Ech0 versions prior to 4.2.0. The issue is a missing authorization check on the GET /api/allusers endpoint, which is publicly accessible and returns user profile metadata without requiring authentication. This allows unauthenticated remote attackers to enumerate users and access their profile information. A fix addressing this issue is available in version 4.2.0.