GHSA-m983-7426-5hrj · Severity: medium · Ecosystem: go — Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint
Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to version 4.2.0, `GET /api/allusers` is mounted as a public endpoint and returns user records without authentication. This allows remote unauthenticated user enumeration and exposure of user profile metadata. A fix is available in v4.2.0.
Conclusion & alert: CVE-2026-33638 is rated Low Risk (24.4/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.03%). Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-04-21 | 0.06% | 0.03% | -0.03% |
| 2 | 2026-03-27 | — | 0.06% | — |
Full EPSS history (2 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 5.3 | 3.1 | MEDIUM |
|
3.9 | 1.4 | [email protected] |
GHSA-m983-7426-5hrj · Severity: medium · Ecosystem: go — Ech0 authenticated user-list exposed data via public `/api/allusers` endpoint
| URL | Tags |
|---|---|
| https://github.com/lin-snow/Ech0/commit/acbf1fd71011e6b9e1e6a911128056a19862f681 | Patch |
| https://github.com/lin-snow/Ech0/releases/tag/v4.2.0 | Product Release Notes |
| https://github.com/lin-snow/Ech0/security/advisories/GHSA-m983-7426-5hrj | Vendor Advisory |