CVE-2026-79668

Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the favcount...

CVE-2026-79661

Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the favcount counter of any echo including private echoes by supplying its UUID, which can be harvested from the public GET...

CVE-2026-79661: Allocation of Resources Without Limits or Throttling

Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the favcount counter of any echo including private echoes by supplying its UUID, which can be harvested from the public GET...

CVE-2026-79668: Missing Authentication for Critical Function

Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the favcount...

PT-2026-41606

Summary PUT /api/echo/like/:id at internal/router/echo.go:12 is registered on PublicRouterGroup with no authentication and no rate limit. Anonymous callers increment the fav count counter on any echo including private echoes by UUID, repeat the request without deduplication, and trigger a databas...

PT-2026-41607

Summary No authentication is required to invoke PUT /api/echo/like/:id. The handler is registered on the public router group. The service increments fav count for the given echo without checking identity, without a per-user limit, and without CSRF tokens. A remote client can arbitrarily inflate...