CVE-2026-79661 Ech0 before 4.7.3 Unauthenticated fav_count Modification
Unauthenticated attackers can modify favorite counts and cause denial of service by exploiting an unprotected API endpoint in Ech0.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-79661?
CVE-2026-79661 is a medium-severity missing authorization vulnerability in lin-snow Ech0, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group without authentication or rate limiting. Unauthenticated attackers can increment the fav_count counter of any echo (including private echoes) by supplying its UUID, which can be harvested from the public GET /api/echo/page feed. Repeated requests are accepted without deduplication, each triggering a database write and a four-key cache invalidation, allowing attackers to inflate popularity metrics and amplify load on the database and cache. Fixed in 4.7.3.
Weakness: CWE-770
Which versions are affected by CVE-2026-79661?
3 open source packages ship an affected version, including github.com/lin-snow/Ech0 and github.com/lin-snow/ech0.
| Package | Affected | Fixed in |
|---|---|---|
github.com/lin-snow/Ech0 Go | All versions | 1.4.8-0.20260503035905-cecc2c19b590 |
github.com/lin-snow/Ech0 Go | All versions | 1.4.8-0.20260503035905-cecc2c19b590 |
github.com/lin-snow/ech0 Go | All versions | 1.4.8-0.20260503035905-cecc2c19b590 |
How do I fix CVE-2026-79661?
Upgrade github.com/lin-snow/Ech0 to 1.4.8-0.20260503035905-cecc2c19b590 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-79661 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-79661 exists.
Sources
Also known as GHSA-7xcp-744q-324g, GHSA-pj6q-4vq4-r8cg, GO-2026-5541.