{"action":"Upgrade github.com/lin-snow/ech0 to 1.4.8-0.20260503035905-cecc2c19b590 or later.","affected":[{"fixed":"1.4.8-0.20260503035905-cecc2c19b590","introduced":"0"}],"component":"github.com/lin-snow/ech0","cve_ids":["CVE-2026-79661"],"ecosystem":"Go","epss":0.0043,"exploited":false,"fixed_versions":["1.4.8-0.20260503035905-cecc2c19b590"],"ghsa_id":"GHSA-pj6q-4vq4-r8cg","id":"tcs_01M5KGN494F7F3943TJXPD4C29","modified_at":"2026-08-27T04:10:29.182372849Z","published_at":"2026-06-25T22:34:34Z","references":["https://osv.dev/vulnerability/GO-2026-5541","https://github.com/lin-snow/Ech0/security/advisories/GHSA-pj6q-4vq4-r8cg","https://github.com/lin-snow/Ech0/commit/cecc2c19b590df85d79ea98457faa143130cd620"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-5541","url":"https://osv.dev/vulnerability/GO-2026-5541"}],"summary":"Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo's fav_count in github.com/lin-snow/ech0"}