CVE-2026-79661
Received Received - Intake

Unauthenticated PUT Request Leading to Database Cache Abuse in Ech0

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the fav_count counter of any echo (including private echoes) by supplying its UUID, which can be harvested from the public GET /api/echo/page feed. Repeated requests are accepted without deduplication, each triggering a database write and a four-key cache invalidation, allowing attackers to inflate popularity metrics and amplify load on the database and cache. Fixed in 4.7.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-79661
EUVD
EUVD-2026-65453

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-79661 is a vulnerability in Ech0 versions before 4.7.3 where an unauthenticated PUT endpoint at /api/echo/like/:id allows attackers to increment the fav_count of any echo, including private ones, by using its UUID obtained from a public feed. Each request triggers database writes and cache invalidations without deduplication, enabling attackers to artificially inflate popularity metrics and overload system resources.

Detection Guidance

Monitor for unusual PUT requests to /api/echo/like/:id endpoints without authentication headers. Check for repeated requests with the same UUID or rapid fav_count increments in database logs. Use network traffic analysis tools like tcpdump or Wireshark to inspect HTTP PUT requests targeting this path.

Impact Analysis

This vulnerability can lead to inflated popularity metrics, bypassing private echo restrictions, and causing database and cache overload due to repeated writes and cache invalidations. Attackers can manipulate metrics without authentication or rate limits, affecting system performance and data integrity.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling unauthorized data manipulation. Inflating popularity metrics may misrepresent user engagement, potentially violating integrity requirements. Database and cache overload could disrupt system availability, affecting service reliability under both regulations.

Mitigation Strategies

Upgrade Ech0 to version 4.7.3 or later. Move the /api/echo/like/:id endpoint to an authenticated route group. Implement rate limiting and deduplication to prevent repeated requests. Add ownership checks to block unauthorized modifications to private echoes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79661. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart