Executive brief
Ech0 is a social media platform that allows users to share posts and engage with content through features like counts. An attacker can bypass authentication on the like endpoint and repeatedly increment engagement metrics (favorite counts) for any post without any identity verification or rate limiting. This allows malicious actors to artificially inflate like counts and manipulate social ranking systems, undermining trust in the platform's engagement metrics and feed algorithms.
Technical details
The vulnerability is a missing authentication check in the PUT /api/echo/like/:id endpoint, registered on the public router group in internal/router/echo.go. The LikeEcho service function in internal/service/echo/echo.go performs only a database increment operation without validating user identity, enforcing per-user limits, or requiring CSRF tokens. An attacker can discover or guess a public echo UUID from the timeline or API, then send unauthenticated PUT requests to arbitrarily increment the fav_count field. The attack requires only network access and no privileges or user interaction. Patched versions (4.7.3 and later) address the issue; remediation should include authentication enforcement or rate limiting with proof-of-work mechanisms.
Affected products
- lin-snow Ech0 before 4.7.3
Timeline
- 2026-05-03: disclosed: Security advisory published on GitHub
- 2026-08-25: patched: Version 4.7.3 released with fix