Unauthenticated Database Manipulation in Ech0 by Lin Snow

CVE-2026-79661

What is CVE-2026-79661?

The Ech0 application, prior to version 4.7.3, exposes an insecure PUT endpoint (/api/echo/like/:id) that allows unauthenticated users to manipulate the fav_count metrics of any echo by simply providing its UUID, obtainable from public data feeds. This vulnerability enables attackers to amplify database and cache loads by sending repeated requests, resulting in inefficient resource usage and potentially skewing popularity metrics. Security measures such as authentication and rate limiting were absent, making it imperative for users to update to the latest version to mitigate these risks.

References