Incorrect Authorization Affecting github.com/labstack/echo/v4/middleware package, versions >=4.0.0 <4.16.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMLABSTACKECHOV4MIDDLEWARE-21691672
- published24 Oct 2026
- disclosed23 Oct 2026
- creditUnknown
Introduced: 23 Oct 2026
New CVE NOT AVAILABLE CWE-444 (opens in a new tab)How to fix?
Upgrade github.com/labstack/echo/v4/middleware to version 4.16.1 or higher.
Overview
github.com/labstack/echo/v4/middleware is a middleware package for echo.
Affected versions of this package are vulnerable to Incorrect Authorization in the Proxy process. An attacker can gain unauthorized access to protected resources by sending a WebSocket upgrade request that is rejected by the upstream, causing subsequent HTTP requests to bypass route-level access controls and middleware. This is only exploitable if a proxy route is accessible, the upstream rejects the upgrade without closing the connection, and the target resource on the upstream lacks independent authorization.
Workaround
This vulnerability can be mitigated by rejecting WebSocket upgrade requests before they reach affected proxy routes, or by enforcing authorization independently at every upstream resource.