CVE-2026-79661: Ech0 Authentication Bypass Vulnerability

CVE-2026-79661 Overview

CVE-2026-79661 affects Ech0, a self-hosted microblogging platform, through version 4.5.6. The PUT /api/echo/like/:id endpoint is registered on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the fav_count counter of any echo, including private echoes, by supplying its UUID. UUIDs can be harvested from the public GET /api/echo/page feed. Repeated requests are accepted without deduplication, each triggering a database write and a four-key cache invalidation. The issue is tracked as [CWE-770: Allocation of Resources Without Limits or Throttling] and fixed in version 4.7.3.

Critical Impact
Unauthenticated attackers can inflate popularity metrics on arbitrary echoes and amplify load on the database and cache layer through repeated writes.

Affected Products

Ech0 versions up to and including 4.5.6
Fixed in Ech0 4.7.3

Discovery Timeline

2026-08-25 - CVE-2026-79661 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79661

Vulnerability Analysis

Ech0 exposes the PUT /api/echo/like/:id route inside the public router group. The route handler updates the fav_count field for the echo identified by the supplied UUID. No authentication middleware, session check, or per-client rate limit protects the endpoint. The server also lacks deduplication logic, so identical requests from the same source are all processed.

Each accepted request performs a database write to persist the incremented counter. It also invalidates four cache keys associated with the affected echo. An attacker can chain these operations at high frequency to inflate metrics and generate resource pressure on backend services.

Root Cause

The root cause is missing access control combined with absent rate limiting on a state-changing endpoint. The route was registered on the public router group rather than an authenticated group. There is no idempotency key, no per-user tracking, and no throttling to bound resource consumption per client.

Attack Vector

An unauthenticated attacker first calls GET /api/echo/page to enumerate echo UUIDs from the public feed. Even private echoes can be targeted once their UUID is known, because the like endpoint does not check visibility. The attacker then issues repeated PUT /api/echo/like/:id requests against selected UUIDs. Each request increases the fav_count value and forces a database write with a four-key cache invalidation. Sustained abuse manipulates trending or popularity signals and increases load on the database and cache tier.

No verified public exploit code is available. Refer to the GitHub Security Advisory and the VulnCheck Security Advisory for additional technical details.

Detection Methods for CVE-2026-79661

Indicators of Compromise

High-volume PUT requests to /api/echo/like/:id from a single IP address or a small set of source addresses.
Sudden growth in the fav_count value for one or more echoes without a corresponding increase in user sessions or traffic.
Elevated database write rates and cache invalidation events correlated with the like endpoint.

Detection Strategies

Alert on anomalous request-per-second rates against PUT /api/echo/like/:id in web server or reverse proxy logs.
Correlate fav_count deltas against authenticated session counts to surface counter inflation.
Monitor for repeated requests to the same :id from the same source within short time windows.

Monitoring Recommendations

Enable structured logging on the Ech0 application and forward logs to a centralized analytics platform.
Track database write and cache invalidation metrics on the echo and related tables.
Baseline normal like-endpoint traffic and configure alerts on statistical deviations.

How to Mitigate CVE-2026-79661

Immediate Actions Required

Upgrade Ech0 to version 4.7.3 or later, which contains the vendor fix.
Restrict access to /api/echo/like/:id behind an authenticated router group until the upgrade is applied.
Deploy rate limiting at the reverse proxy or WAF layer for the like endpoint.

Patch Information

The vendor addressed the issue in Ech0 version 4.7.3 by requiring authentication and applying request controls on the like endpoint. Deployment details are documented in the GitHub Security Advisory GHSA-pj6q-4vq4-r8cg.

Workarounds

Block or rate-limit PUT /api/echo/like/:id at an upstream proxy such as Nginx, HAProxy, or a CDN.
Require authenticated session cookies or tokens before forwarding requests to the like endpoint.
Add per-IP and per-UUID request throttling to bound database writes and cache invalidations.

bash

# Nginx example: rate limit the like endpoint to 5 requests/minute per client IP
limit_req_zone $binary_remote_addr zone=ech0_like:10m rate=5r/m;

location ~ ^/api/echo/like/ {
    limit_req zone=ech0_like burst=5 nodelay;
    limit_except PUT { deny all; }
    proxy_pass http://ech0_backend;
}