PT-2026-41607

Summary No authentication is required to invoke PUT /api/echo/like/:id. The handler is registered on the public router group. The service increments fav count for the given echo without checking identity, without a per-user limit, and without CSRF tokens. A remote client can arbitrarily inflate...

PT-2026-41606

Summary PUT /api/echo/like/:id at internal/router/echo.go:12 is registered on PublicRouterGroup with no authentication and no rate limit. Anonymous callers increment the fav count counter on any echo including private echoes by UUID, repeat the request without deduplication, and trigger a databas...