Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-79668

Ech0 before 4.7.3 Unauthenticated Like Endpoint Metric Inflation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the fav_count field for any known echo identifier, compromising the integrity of engagement metrics and social ranking systems.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

lin-snow Ech0

Default version status: unaffected

  • 0 to < 4.7.3affected
  • 4.7.3unaffected
pkg:golang/github.com/lin-snow/ech0

References