CVE-2026-79668: Ech0 before 4.7.3 Unauthenticated Like Endpoint Metric Inflation
Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the favcount field for any known echo identifier, compromising the integrity of engagement metrics and social ranking systems.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments running Ech0 versions before 4.7.3 are exposed if the PUT /api/echo/like/:id endpoint is reachable by an attacker. No authentication is required to exploit the affected endpoint.
What does an attacker need to exploit it?
An attacker only needs a known echo identifier and network access to the endpoint. They can repeatedly send PUT requests to increment that echo's fav_count value.
Are confidentiality or availability affected?
The provided severity vector indicates an integrity impact only. The reported effect is manipulation of engagement metrics and potentially social-ranking systems, not disclosure of data or service disruption.
How can I tell whether exploitation may have occurred?
Review engagement metrics for unexpectedly high fav_count values, particularly on known echo identifiers. Repeated unauthenticated requests to the like endpoint would be consistent with the described abuse.