The Ech0 application exposes a public API endpoint for liking content that does not require authentication. This allows any remote client to increment the like count arbitrarily by sending repeated unauthenticated requests. The vulnerability undermines the integrity of engagement metrics, enabling attackers to inflate like counts and distort social proof. The flaw affects versions prior to 1.4.8-0.20260503040728-a7e8b8e84bd1. A fix is available in version 1.4.8-0.20260503040728-a7e8b8e84bd1.