https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-14T19:34:12.090398+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-33638 CVE-2026-33638 — Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint 2026-10-14T19:34:12.091488+00:00

Affected: lin-snow Ech0

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to version 4.2.0, `GET /api/allusers` is mounted as a public endpoint and returns user records without authentication. This allows remote unauthenticated user enumeration and exposure of user profile metadata. A fix is available in v4.2.0.