{"id":"ghsa-ghsa-r7w9-592q-9vg4","seq":2056989,"kind":"advisory","title":"Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method","url":"https://github.com/advisories/GHSA-r7w9-592q-9vg4","permalink":"https://vulnpulse.app/items/ghsa-ghsa-r7w9-592q-9vg4","summary":"影響: go:github.com/labstack/echo/v5 >= 5.0.0, < 5.4.0 → 5.4.0, go:github.com/labstack/echo/v4 < 4.16.0 → 4.16.0\nThe MethodOverride middleware accepts any non-empty string as the override target method — including safe methods (GET, HEAD, OPTIONS, TRACE) — when rewriting a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain (e.Use()), it rewrites the request method to a safe method before CSRF evaluates it. The CSRF middleware then skips token validation for the now-safe method, allowing state-changing POST handlers to execute without any CSRF check. Both the l…","severity":"medium","techs":["go","github"],"cves":["CVE-2026-118266"],"tags":["GHSA-r7w9-592q-9vg4","github.com/labstack/echo/v5","github.com/labstack/echo/v4"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T19:53:36.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}