CVE-2026-33638

Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to version 4.2.0, `GET /api/allusers` is mounted as a public endpoint and returns user records without authentication. This allows remote unauthenticated user enumeration and exposure of user profile metadata. A fix is available in v4.2.0.

• CWE-862

• https://github.com/lin-snow/Ech0/commit/acbf1fd71011e6b9e1e6a911128056a19862f681Patch
• https://github.com/lin-snow/Ech0/releases/tag/v4.2.0Product, Release Notes
• https://github.com/lin-snow/Ech0/security/advisories/GHSA-m983-7426-5hrjVendor Advisory

Published

Mar 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33632ClearanceKit intercepts file-system access events on macOS a…7.8
• CVE-2026-33633Kitty is a cross-platform GPU based terminal. Versions 0.46.…8.8
• CVE-2026-33634Trivy is a security scanner. On March 19, 2026, a threat act…8.8
• CVE-2026-33635iCalendar is a Ruby library for dealing with iCalendar files…4.3
• CVE-2026-33636LIBPNG is a reference library for use in applications that r…7.6
• CVE-2026-33637Faraday is an HTTP client library abstraction layer that pro…6.5
• CVE-2026-33640Outline is a service that allows for collaborative documenta…9.8
• CVE-2026-33641Glances is an open-source system cross-platform monitoring t…7.8
• CVE-2026-33642Kitty is a cross-platform GPU based terminal. In versions 0.…9.8
• CVE-2026-33643SQL Injection vulnerability in SchemaHero 0.23.0 via the col…7.4
• CVE-2026-33644Lychee is a free, open-source photo-management tool. Prior t…4.3
• CVE-2026-33645Fireshare facilitates self-hosted media and link sharing. In…8.1