EUVD-2026-102196

Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additionaldata array and CheckoutService::preparePurchaseParameters merges it after server-computed purchase parameters. Because later...

CVE-2026-77470

The Lychee photo-management tool (prior to version 7.7.1 ) is vulnerable to a parameter tampering flaw in its Supporter or Pro webshop. The POST /api/v2/Shop/Checkout/Process flow allows an unauthenticated buyer to provide an unrestricted additional_data array. Because CheckoutService::preparePur...

CVE-2026-77470 Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request

Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additionaldata array and CheckoutService::preparePurchaseParameters merges it after server-computed purchase parameters. Because later...