Cloudanix VulnDB

GHSA-pj6q-4vq4-r8cg

Medium · 6.5

Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_count

CVSS

6.5

EPSS

—

Published

May 7, 2026

CISA due date

—

The record

`PUT /api/echo/like/:id` at `internal/router/echo.go:12` is registered on `PublicRouterGroup` with no authentication and no rate limit. Anonymous callers increment the `fav_count` counter on any echo (including private echoes) by UUID, repeat the request without deduplication, and trigger a database write plus a four-key cache invalidation on every call. Alice harvests echo UUIDs from the public `GET /api/echo/page` response, inflates fav counts at will, and spams writes to amplify load on the DB and cache layers.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities