Cloudanix VulnDB

GHSA-w8jj-cwmc-wgq2

Medium · 4.3

Ech0's Missing Authorization on System Logs Allows Non-Admin Information Disclosure

CVSS

4.3

EPSS

—

Published

Apr 10, 2026

CISA due date

—

The record

The system log endpoints (`GET /api/system/logs`, `GET /api/system/logs/stream`, `WS /ws/system/logs`) lack authorization checks, allowing any authenticated non-admin user to read and stream all server logs. These logs contain error stack traces, internal file paths, module names, and arbitrary structured fields that facilitate reconnaissance for further attacks.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities