CVE-2026-79661

Name of the Vulnerable Software and Affected Versions Ech0 versions prior to 4.7.3

Description The application registers the 'PUT /api/echo/like/:id' endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the fav count counter of any echo, including private ones, by providing its UUID, which can be obtained from the 'GET /api/echo/page' feed. Because repeated requests are accepted without deduplication, each request triggers a database write and a four-key cache invalidation, enabling attackers to inflate popularity metrics and increase the load on the database and cache.

Recommendations Update to version 4.7.3.