CVE-2026-79661

Ech0 (through 4.5.6) exposes the PUT /api/echo/like/:id endpoint on its public router group with no authentication and no rate limiting . An unauthenticated attacker can increment the fav_count counter of any echo—including private ones—by supplying its UUID, which is harvestable from the public ...