{"affected":[{"product":"echo","source":"CNA: GitHub_M","vendor":"labstack","versions":[{"status":"affected","version":"< 4.16.0"},{"status":"affected","version":">= 5.0.0, < 5.4.0"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/labstack/echo/v5","product":"github.com/labstack/echo/v5","source":"OSV GHSA-r7w9-592q-9vg4","vendor":"","versions":[{"events":[{"introduced":"5.0.0"},{"fixed":"5.4.0"}],"lessThan":"5.4.0","status":"affected","version":"5.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/labstack/echo/v4","product":"github.com/labstack/echo/v4","source":"OSV GHSA-r7w9-592q-9vg4","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"4.16.0"}],"lessThan":"4.16.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118266","cwes":["CWE-352"],"description":"Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POST handler but the override changes the method before CSRF evaluates it, causing both token validation and Sec-Fetch-Site checks to be skipped. A cross-site exploit requires an authenticated victim and an override value that a browser-submitted request can control, such as the form getter used by the advisory reproducer; the default X-HTTP-Method-Override header getter is not settable by a cross-site form. This issue is fixed in 4.16.0 and 5.4.0.","epss":{"date":"2026-11-02","percentile":0.05492,"score":0.00163},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/labstack/echo/security/advisories/GHSA-r7w9-592q-9vg4"}],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"}],"modifiedAt":1793712372648,"publishedAt":1793215307729,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/labstack/echo/security/advisories/GHSA-r7w9-592q-9vg4"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/releases/tag/v4.16.0"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/releases/tag/v5.4.0"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/labstack/echo/security/advisories/GHSA-r7w9-592q-9vg4"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-r7w9-592q-9vg4"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-r7w9-592q-9vg4"}],"remediation":[{"kind":"fix","source":"OSV GHSA-r7w9-592q-9vg4","text":"github.com/labstack/echo/v5 (Go): OSV reports a fixed version 5.4.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-r7w9-592q-9vg4"},{"kind":"fix","source":"OSV GHSA-r7w9-592q-9vg4","text":"github.com/labstack/echo/v4 (Go): OSV reports a fixed version 4.16.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-r7w9-592q-9vg4"}],"revision":"e0324cb08aa8b889b6c84dcdf0252635cd3dc512f35753fe31517a894b096323","sources":[{"modifiedAt":1793712372648,"name":"CNA: GitHub_M","retrievedAt":1793714944050,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118266"},{"modifiedAt":1793217603851,"name":"OSV / GitHub Security Advisories","retrievedAt":1793714944579,"url":"https://osv.dev/vulnerability/GHSA-r7w9-592q-9vg4"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793714965909,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118266"}],"ssvc":{"assessedAt":1793712332791,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method","updatedAt":1793714965909}