Is CVE-2026-79668 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79668 being exploited in the wild.

How severe is CVE-2026-79668?

Medium severity, with a CVSS score of 5.3, published 25 August 2026.

Which products and versions are affected?

github.com/lin-snow/ech0 (Go) SEMVER:introduced=0,fixed=1.4.8-0.20260503040728-a7e8b8e84bd1; Lin-Snow Ech0 before 4.7.3.

Is there a fix for CVE-2026-79668?

Yes. github.com/lin-snow/ech0 (Go): upgrade to 1.4.8-0.20260503040728-a7e8b8e84bd1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-79668 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-79668?

Check whether you run github.com/lin-snow/ech0 (Go) or Lin-Snow Ech0 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79668: Ech0 authentication bypass in like endpoint

CVE-2026-79668 · Severity: medium · CVSS 5.3 · Published 2026-08-25

Ech0 is a social media platform that allows users to share posts and engage with content through features like counts. An attacker can bypass authentication on the like endpoint and repeatedly increment engagement metrics (favorite counts) for any post without any identity verification or rate limiting. This allows malicious actors to artificially inflate like counts and manipulate social ranking systems, undermining trust in the platform's engagement metrics and feed algorithms.

Technologies: github.com/lin-snow/ech0 (Go), Lin-Snow Ech0. Vendors: Go, Lin-Snow.

Quick answers

Is CVE-2026-79668 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79668 being exploited in the wild.
How severe is CVE-2026-79668?: Medium severity, with a CVSS score of 5.3, published 25 August 2026.
Which products and versions are affected?: github.com/lin-snow/ech0 (Go) SEMVER:introduced=0,fixed=1.4.8-0.20260503040728-a7e8b8e84bd1; Lin-Snow Ech0 before 4.7.3.
Is there a fix for CVE-2026-79668?: Yes. github.com/lin-snow/ech0 (Go): upgrade to 1.4.8-0.20260503040728-a7e8b8e84bd1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79668 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-79668?: Check whether you run github.com/lin-snow/ech0 (Go) or Lin-Snow Ech0 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/lin-snow/ech0 (Go): upgrade to 1.4.8-0.20260503040728-a7e8b8e84bd1 or later
```
go get github.com/lin-snow/ech0@v1.4.8-0.20260503040728-a7e8b8e84bd1
```

Technical details

The vulnerability is a missing authentication check in the PUT /api/echo/like/:id endpoint, registered on the public router group in internal/router/echo.go. The LikeEcho service function in internal/service/echo/echo.go performs only a database increment operation without validating user identity, enforcing per-user limits, or requiring CSRF tokens. An attacker can discover or guess a public echo UUID from the timeline or API, then send unauthenticated PUT requests to arbitrarily increment the fav_count field. The attack requires only network access and no privileges or user interaction. Patched versions (4.7.3 and later) address the issue; remediation should include authentication enforcement or rate limiting with proof-of-work mechanisms.

Affected products

lin-snow Ech0 before 4.7.3

Identifiers

CVE-2026-79668
GHSA-rgj7-vg8v-j4wr
GO-2026-5623

Timeline

2026-05-03: disclosed: Security advisory published on GitHub
2026-08-25: patched: Version 4.7.3 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.