EUVD-2026-65446
GHSA-7v7f-8gw6-2q2x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEnumerate echo IDs via unauthenticated GET /api/echo/page
-
DeliverySend unauthenticated PUT /api/echo/like/{id}
-
ExploitPublic router bypasses JWT middleware
-
ExecutionService increments fav_count with no identity check
-
ImpactRepeat in loop to inflate metrics arbitrarily
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication is required - the route is registered in PublicRouterGroup, which explicitly excludes JWT middleware enforcement. The only prerequisite is a valid echo ID, which is obtainable without credentials via the public GET /api/echo/page timeline endpoint. There is no rate limiting, no CSRF token, no per-user binding, and no request frequency check in the handler or service layer. Exploitation is constrained to Ech0 instances reachable over a network from the attacker; instances isolated to localhost or a private LAN without external exposure are not remotely exploitable. Impact is strictly limited to integrity of the fav_count engagement metric - there is no code execution path, no data exfiltration, and no denial of service consequence from this endpoint. |
| Impact | The CVSS 4.0 score of 6.9 accurately reflects the attack profile: network-accessible (AV:N), no complexity barrier (AC:L), no authentication required (PR:N), no user interaction (UI:N), with low integrity impact (VI:L) and no confidentiality or availability consequence. The real-world risk is bounded by Ech0's limited deployment footprint - this is a niche self-hosted platform, not enterprise infrastructure - so the aggregate exposure is narrow. The absence of rate limiting is the amplifying factor: a single attacker with scripted HTTP calls can inflate any post's like count by thousands in seconds, corrupting content ranking without any privileged access. No EPSS score was provided in the intelligence; exploitation probability is inferred as moderate-to-high given the trivial attack path and public proof-of-concept. Active exploitation is not confirmed by CISA KEV. The integrity-only impact means this is not an emergency for most operators, but any Ech0 instance where engagement metrics influence content visibility or trust signals should treat this as a priority patch. |
| Exploit ScenarioDerived | An attacker finds a publicly reachable Ech0 instance and issues a single unauthenticated GET /api/echo/page request to enumerate valid echo UUIDs from the public timeline. They then script a loop of unauthenticated PUT /api/echo/like/{ECHO_ID} requests - exactly as demonstrated in the GHSA proof-of-concept - inflating the fav_count of a targeted post by an arbitrary amount to manipulate its ranking in feeds or search results. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Unauthenticated metric inflation in Ech0 before 4.7.3 allows any remote attacker to arbitrarily increment the fav_count field of any post by repeatedly calling PUT /api/echo/like/:id without credentials or rate limiting. The endpoint is explicitly registered on the public router group, bypassing all JWT authentication middleware, and the service layer performs no identity check or per-user binding before executing the database increment. A proof-of-concept is publicly documented in GHSA advisory GHSA-rgj7-vg8v-j4wr; no active exploitation is confirmed via CISA KEV.
RemediationAI
Upgrade Ech0 to version 4.7.3 or later, which incorporates the fix from commit a7e8b8e84bd1e3db090dfb720f2c6c433356b442; Go module consumers should update to github.com/lin-snow/ech0 at pseudo-version 1.4.8-0.20260503040728-a7e8b8e84bd1 or any later tagged release. The vendor advisory at https://github.com/lin-snow/Ech0/security/advisories/GHSA-rgj7-vg8v-j4wr confirms the patch. As a compensating control before patching, operators can configure a reverse proxy (nginx, Caddy) to apply per-IP rate limiting on PUT /api/echo/like/* requests - this reduces automated bulk inflation but does not prevent distributed abuse from multiple source IPs. Restricting the Ech0 instance to private network access entirely eliminates the remote attack vector at the cost of public accessibility.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Ech0 is a self-hosted Go-based social note and blogging platform by lin-snow (CPE: cpe:2.3:a:lin-snow:ech0:*:*:*:*:*:*:*:*). The affected route, PUT /api/echo/like/:id, is explicitly placed in the PublicRouterGroup within internal/router/echo.go, meaning the Gin framework never applies the JWT authentication middleware to it. The LikeEcho function in internal/service/echo/echo.go wraps a raw repository increment in a database transaction with no viewer-identity binding, no session check, and no rate-limit guard. This is a textbook CWE-306 (Missing Authentication for Critical Function) defect: a state-mutating operation that should require identity verification has been categorically excluded from authentication enforcement at the routing layer.
Know when Ech0 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Endpoint is explicitly public with no auth middleware; impact is confined to low-integrity metric inflation with no confidentiality or availability loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the fav_count field for any known echo identifier, compromising the integrity of engagement metrics and social ranking systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Persistent authentication bypass in Ech0 (lin-snow's self-hosted lightweight publishing/memo app) before 4.7.3 lets an a
OAuth redirect URI validation in Ech0 through 4.5.6 allows session hijacking via exchange-code theft by exploiting incom
Authorization bypass in Ech0 before 4.5.1 allows any authenticated non-admin user to invoke privileged admin endpoints b
Denial of service in Ech0 before 5.0.1 allows unauthenticated remote attackers to saturate server CPU by exploiting a qu
Privilege escalation in Ech0 before 4.4.3 allows an attacker holding an admin's profile:read access token to change the
Server-side request forgery in Ech0 before version 4.7.3 allows authenticated users to pivot through the application ser
Scope enforcement in Ech0 4.3.4 and earlier is opt-in at the route level, meaning privileged admin routes that omit the
Missing administrator authorization on dashboard log endpoints in Ech0 before 4.4.3 allows any authenticated low-privile
Scope enforcement bypass in Ech0's comment panel admin API allows any holder of a valid admin-issued access token - rega
Unauthenticated remote attackers can increment the fav_count of any echo - including private ones - in Ech0 through 4.5.
Ech0 before version 4.7.3 exposes guest commenter email addresses to unauthenticated remote callers via public comment-l
Unsalted MD5 password hashing in Ech0's `MD5Encrypt` function (`internal/util/crypto/crypto.go`) stores credentials in a
Exploit-DB