An unauthenticated vulnerability in the Echo Open-Source Community System allows remote attackers to trigger excessive email traffic, resulting in a denial of service for system resources.

This vulnerability involves an improper authentication check at the /sendEmailCodeForResetPwd endpoint, which allows any unauthenticated attacker to force the application to send arbitrary email verification messages.

The exploitation of this flaw can lead to significant service degradation or denial of service by exhausting mail server quotas or triggering rate limits on downstream email providers. Given the CVSS score of 7.5, this high-severity issue poses a credible threat to system availability and may lead to operational disruption or reputational harm through unauthorized email abuse.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /sendEmailCodeForResetPwd endpoint or disable the affected password reset functionality until a vendor update is released.

Proactive Monitoring: Monitor mail server logs and application logs for a sudden spike in outbound verification email requests originating from the identified endpoint.

Compensating Controls: Implement rate limiting on the specific API endpoint or utilize a Web Application Firewall (WAF) to block requests containing anomalous parameters that initiate password reset sequences.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub Gist.

This vulnerability presents a clear risk to service availability and should be addressed as a priority. While a formal patch is pending, organizations must implement compensatory controls, such as network-level access restrictions or WAF rules, to prevent unauthorized access to the vulnerable reset endpoint and mitigate the risk of denial of service.