CVE-2026-77470

The Lychee photo-management tool (prior to version 7.7.1 ) is vulnerable to a parameter tampering flaw in its Supporter or Pro webshop. The POST /api/v2/Shop/Checkout/Process flow allows an unauthenticated buyer to provide an unrestricted additional_data array. Because CheckoutService::preparePur...