The flaw exists in Ech0 up to version 4.5.6, where the /api/echo/like/:id endpoint is exposed on the public router group without authentication or rate limiting. Unauthorized users can increment the fav_count for any echo, including private ones, by supplying the echo's UUID. Each request triggers a database write and a four‑key cache invalidation, allowing attackers to inflate popularity metrics and increase load on backend services.

Affected systems are installations of the Ech0 application from the vendor lin‑snow, specifically versions up to and including 4.5.6. Versions 4.7.3 and newer contain the patch that authenticates or removes the vulnerable endpoint.

The CVSS score of 6.9 indicates moderate severity, and the lack of authentication makes the attack vector network‑based, allowing remote attackers to send arbitrary requests. While EPSS data is not available, the vulnerability is not listed in CISA KEV. Repeated abuse can lead to denial‑of‑service conditions or manipulation of popularity metrics, as the endpoint accepts requests without deduplication and triggers database writes and cache invalidations.