CVE-2026-33638: 
vulnerability analysis and mitigation

CVE-2026-33638 is a missing authorization vulnerability in Ech0, a Go-based application, that allows unauthenticated users to retrieve the full user list via the public GET /api/allusers endpoint. The flaw affects all Ech0 versions prior to 4.2.0 (specifically version 4.1.9 and earlier). It was published by the maintainer on March 22, 2026, added to the GitHub Advisory Database on March 24, 2026, and assigned a CVE on March 26, 2026. The CVSS v3.1 base score is 5.3 (Medium) (GitHub Advisory).

The root cause is a misconfiguration in the routing layer (CWE-862: Missing Authorization), where the /allusers endpoint was registered under the public router group (PublicRouterGroup) instead of the authenticated router group (AuthRouterGroup) in internal/router/user.go. The handler itself was annotated with @Security ApiKeyAuth, indicating it was intended to require authentication, but the routing configuration did not enforce this. As a result, any unauthenticated HTTP GET request to /api/allusers returns user records including usernames, email addresses, role flags, avatar values, and locale information — while the comparable /api/user endpoint correctly returns HTTP 401 when accessed without a token (GitHub Advisory, Fix Commit).

Successful exploitation exposes user profile metadata — including usernames, email addresses, role flags, and locale information — to any unauthenticated party with network access to the API. This enables account enumeration, which can facilitate targeted phishing campaigns, credential stuffing, and social engineering attacks against identified users. There is no integrity or availability impact; the vulnerability is limited to a confidentiality breach of user profile data (GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation at this time. The attack requires no authentication, no user interaction, and no special privileges — only network access to the exposed API endpoint, making it trivially exploitable if the application is internet-facing. The EPSS score is approximately 0.062% (0.027% per GitHub Advisory), indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Ech0 instances using search engines (e.g., Shodan, Censys) or by directly probing known deployment URLs for the application's API.
2. Confirm vulnerability: Send an unauthenticated HTTP GET request to /api/allusers on the target host (e.g., curl -s http://<target>/api/allusers) and observe whether a 200 OK response with user data is returned instead of a 401 Unauthorized.
3. Enumerate users: Parse the JSON response to extract user profile metadata, including usernames, email addresses, role flags, avatar values, and locale information for all registered accounts.
4. Leverage for follow-on attacks: Use the harvested email addresses and usernames to conduct targeted phishing, credential stuffing against the login endpoint (POST /api/login), or social engineering attacks against identified users (GitHub Advisory).

• Network: Unauthenticated HTTP GET requests to /api/allusers from external or unexpected IP addresses, particularly in high volume (indicative of automated enumeration).
• Logs: Web server or application access logs showing repeated GET /api/allusers requests returning HTTP 200 without an Authorization header or session token; unusual spikes in requests to this endpoint from a single source IP.
• Behavioral: Subsequent login attempts (POST /api/login) using usernames or emails harvested from the /api/allusers endpoint, especially from the same source IP or shortly after enumeration activity.

Upgrade Ech0 to version 4.2.0 or later, which moves the /allusers endpoint from the public router group to the authenticated router group, requiring a valid token for access (Ech0 Release, Fix Commit). For deployments that cannot be immediately patched, implement network-level controls (e.g., firewall rules, reverse proxy authentication) to restrict access to the /api/allusers endpoint from untrusted networks. Monitor access logs for unauthenticated requests to this endpoint as a detection measure.