GHSA-rgj7-vg8v-j4wr: Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation

May 7, 2026

No authentication is required to invoke PUT /api/echo/like/:id. The handler is registered on the public router group. The service increments fav_count for the given echo without checking identity, without a per-user limit, and without CSRF tokens. A remote client can arbitrarily inflate like metrics with repeated requests.

References

github.com/advisories/GHSA-rgj7-vg8v-j4wr
github.com/lin-snow/Ech0/commit/a7e8b8e84bd1e3db090dfb720f2c6c433356b442
github.com/lin-snow/Ech0/security/advisories/GHSA-rgj7-vg8v-j4wr

Code Behaviors & Features

Detect and mitigate GHSA-rgj7-vg8v-j4wr with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →