CVE-2026-118266

Name of the Vulnerable Software and Affected Versions Echo versions prior to 4.16.0 Echo versions prior to 5.4.0

Description The MethodOverride middleware allows a POST request to be rewritten to a safe HTTP method (such as GET, HEAD, OPTIONS, or TRACE). When this middleware is registered before the CSRF middleware in the post-routing chain, the request method is changed before the CSRF middleware evaluates it. Consequently, the CSRF middleware skips token validation and Sec-Fetch-Site checks for what it perceives as a safe method, while the original state-changing POST handler still executes. This allows an authenticated victim to be tricked into performing state-changing operations via a cross-site request. The issue stems from the MethodOverrideConfig.ToMiddleware() function in middleware/method override.go lacking a whitelist for target methods, and the CSRFConfig.ToMiddleware() function in middleware/csrf.go relying on the rewritten method.

Recommendations Update Echo to version 4.16.0 or later. Update Echo to version 5.4.0 or later. As a temporary workaround, register the MethodOverride middleware using e.Pre() instead of e.Use(), or ensure the CSRF middleware is registered before the MethodOverride middleware. Restrict the use of the MethodOverride middleware to the default header getter X-HTTP-Method-Override to minimize the risk of cross-site exploitation.