CVE-2026-79661: Ech0 before 4.7.3 Unauthenticated fav_count Modification
Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the favcount counter of any echo (including private echoes) by supplying its UUID, which can be harvested from the public GET /api/echo/page feed. Repeated requests are accepted without deduplication, each triggering a database write and a four-key cache invalidation, allowing attackers to inflate popularity metrics and amplify load on the database and cache. Fixed in 4.7.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.7.3 - Compensating control
Restrict access to the PUT /api/echo/like/:id endpoint to authenticated clients and add rate limiting, since Ech0 through 4.5.6 exposes this endpoint on the public router group without authentication or rate limiting.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated network client that can reach the public API can send requests to the affected endpoint. No account, prior authorization, or user interaction is required.
What does an attacker need to modify an echo's favorite count?
The attacker needs the target echo's UUID. UUIDs can be obtained from the public GET /api/echo/page feed, and the issue affects both public and private echoes once their UUID is known.
Are repeated requests limited or deduplicated?
No. The affected endpoint has no rate limiting or deduplication, so each repeated request increments fav_count and triggers a database write plus invalidation of four cache keys.
What should operators do if they cannot immediately upgrade?
The provided data identifies version 4.7.3 as the fixed release. It does not provide a documented workaround or mitigation for deployments that cannot upgrade.
How can an operator identify potential exploitation?
The provided data does not specify logging indicators or detection methods. Relevant behavior would be repeated PUT requests to /api/echo/like/:id and unexpected increases in echo fav_count values.