Cloudanix VulnDB

GHSA-rgj7-vg8v-j4wr

Medium · 5.3

Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation

CVSS

5.3

EPSS

—

Published

May 7, 2026

CISA due date

—

The record

**No authentication** is required to invoke **`PUT /api/echo/like/:id`**. The handler is registered on the **public** router group. The service increments **`fav_count`** for the given echo **without** checking identity, **without** a per-user limit, and **without** CSRF tokens. A remote client can **arbitrarily inflate** like metrics with repeated requests.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities