Lin-snow vulnerabilities
We track 8 vulnerabilities in Lin-snow products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on August 25, 2026.
Latest Lin-snow vulnerabilities
- 7.6 High severity
Ech0: Improper Authorization
Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token (least-privilege) restrictions on several privileged admin routes. Multiple privileged endpoints (e.g., /api/inbox, /api/panel/comments, /api/backup/export) omit scope checks and auth
- 8.8 High severity
Ech0: Missing Authorization
Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emai
- 7.4 High severity
Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option…
Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to maintain perpetual authenticated access after token theft. Three independent revocation mechanisms fail: logout panics on nil ExpiresAt field, Revo
- 8.0 High severity
Ech0: URL Redirection to Untrusted Site
Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect (internal/service/auth/auth.go) that compares only the scheme and host of the client-supplied redirect_uri against the admin-configured allowlist, igno
- 7.7 High severity
Ech0: Server-Side Request Forgery
Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access int
- 7.5 High severity
Ech0: Uncontrolled Resource Consumption
Ech0 before 5.0.1 does not impose any size or shape limit on the Accept-Language header processed by its i18n middleware, which runs on every HTTP request. The header is passed unfiltered to go-i18n's NewLocalizer, which internally calls golang.org/x/text/lang
- 7.2 High severity
Ech0: Server-Side Request Forgery
Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, the GET /api/website/title endpoint accepts an arbitrary URL via the website_url query parameter and makes a server-side HTTP request to it without any validatio
- 7.5 High severity
Ech0: Server-Side Request Forgery
Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, Ech0 implements link preview (editor fetches a page title) through GET /api/website/title. That is legitimate product behavior, but the implementation is unsafe: