CVE-2026-61838

The photo-management tool Lychee is vulnerable to an authorization bypass in versions prior to 7.6.3 . The GET /api/v2/Zip endpoint fails to enforce AlbumPolicy::canAccess() before calling AlbumPolicy::canDownload() and PhotoPolicy::canDownload(). This allows an unauthenticated attacker who posse...