Ech0 EUVD-2026-65453

The vulnerable condition exists in the default installation of all Ech0 versions through 4.5.6: the PUT /api/echo/like/:id route is registered on PublicRouterGroup at internal/router/echo.go:12 without JWT middleware, rate limiting, or deduplication - this is not a misconfiguration but the default shipped state. No special configuration or elevated access is required; any network-reachable instance is exploitable by anonymous callers. To discover valid target UUIDs, access to the public GET /api/echo/page endpoint is needed, though attackers may also supply known or guessed UUIDs directly. Exploitation is bounded by the absence of data exfiltration (VC:N) - impact is limited to fav_count integrity corruption and database/cache amplification. The like endpoint has no rate-limiting middleware, contrasting with comment creation which enforces 3 requests per 60 seconds and 20 requests per 3600 seconds per IP.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated remote exploitation at zero attack complexity, establishing maximum accessibility. The score of 6.9 reflects limited integrity and availability impact (VI:L/VA:L) with no confidentiality breach - accurate for metric corruption and I/O amplification rather than code execution or data exfiltration. No EPSS data was provided for this CVE, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing is present, meaning widespread active exploitation is not confirmed. However, the GHSA advisory includes a working Python proof-of-concept, making exploitation trivially scriptable for any attacker with network access. The real-world risk is moderate: the attack requires no skill and no credentials, but impact is bounded to popularity metric manipulation and degraded database/cache performance - not system compromise. The four-cache-invalidation amplification factor per request makes this a viable low-sophistication resource exhaustion primitive against smaller self-hosted deployments, where a high request rate could meaningfully degrade service.

An unauthenticated attacker queries the public GET /api/echo/page feed to harvest valid echo UUIDs, then scripts repeated PUT /api/echo/like/:id calls against any target echo - including private ones - with no credentials or session token. Each iteration unconditionally increments the fav_count counter and flushes four cache keys; a tight Python loop (as demonstrated in the GHSA proof-of-concept) can sustain this indefinitely, inflating popularity metrics and amplifying write load on the database and cache until performance degrades.