What’s Vulnerable › Vulnerabilities

CVE-2026-79661: Ech0 before 4.7.3 Unauthenticated fav_count Modification

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-25 · updated 2026-08-31
• Weakness: CWE-770

Description

Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the fav_count counter of any echo (including private echoes) by supplying its UUID, which can be harvested from the public GET /api/echo/page feed. Repeated requests are accepted without deduplication, each triggering a database write and a four-key cache invalidation, allowing attackers to inflate popularity metrics and amplify load on the database and cache. Fixed in 4.7.3.

Affected products

• lin-snow Ech0: before 4.7.3 — fixed in 4.7.3

How to fix

Upgrade to a fixed version: lin-snow Ech0 4.7.3. Check the vendor advisory for mitigations.

References

• https://github.com/lin-snow/Ech0/security/advisories/GHSA-pj6q-4vq4-r8cg
• https://www.vulncheck.com/advisories/ech0-before-unauthenticated-fav-count-modification
• https://github.com/lin-snow/Ech0/security/advisories/GHSA-pj6q-4vq4-r8cg

Get alerted when CVE-2026-79661 or the next vulnerability affects your stack