CVE-2026-118266
Description
A flaw was found in Echo. This vulnerability allows a remote attacker to bypass Cross-Site Request Forgery (CSRF) protections when the MethodOverride middleware is positioned before CSRF validation in the request chain. By tricking an authenticated user into submitting a crafted request that rewrites a state-changing POST request to a safe HTTP method, the application bypasses CSRF checks while still processing the underlying operation. As a result, an attacker can execute unauthorized state-changing actions on behalf of the victim.
Statement
This vulnerability is rated as having a Moderate impact because successful exploitation requires user interaction and depends on non-default middleware configurations to trigger state modifications. Echo applications are only susceptible if the MethodOverride middleware precedes CSRF checks in post-routing and relies on form or query inputs that an external site can manipulate. Furthermore, applications using the default header-based method override remain protected against standard cross-site browser submissions.
Understanding the Weakness (CWE)
Confidentiality,Access Control,Availability
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity; Varies by Context
When security decisions such as authentication and authorization are made based on the values of these inputs, attackers can bypass the security of the product to access whatever is being protected. An attacker could change these inputs using customized clients or other attacks. This change might not be detected. The consequences will depend on the associated functionality, but they can range from granting additional privileges to untrusted users to bypassing important security checks. Ultimately, this weakness may lead to exposure or modification of sensitive data, system crash, or execution of arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
