The Ech0 application exposes a PUT endpoint /api/echo/like/:id that allows unauthenticated users to increment the favorite count (fav_count) of any echo, including private ones, without rate limiting or deduplication. This flaw enables anonymous actors to manipulate popularity metrics, bypass private echo boundaries, and cause increased load on the database and cache layers. The vulnerability exists because the like endpoint is registered on a public router group without authentication or rate limiting, unlike other endpoints that enforce such controls. A fix is available in version 1.4.8-0.20260503035905-cecc2c19b590.