GHSA-PJ6Q-4VQ4-R8CG: Unauthenticated Resource Exhaustion and State Manipulation in Ech0 API

Vulnerability ID: GHSA-PJ6Q-4VQ4-R8CG

CVSS Score: 5.3

Published: 2026-05-07

The Ech0 lightweight publishing platform exposes an unauthenticated, rate-unlimited API endpoint that permits arbitrary modification of content metrics. Because this endpoint directly triggers database transactions and simultaneously invalidates multiple application cache layers, it serves as an exploitable vector for resource exhaustion Denial of Service (DoS) and cache-stampede attacks.

TL;DR

An unauthenticated API endpoint in Ech0 allows attackers to artificially inflate post metrics.…