CVE-2026-77466

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::getsupportedproviders, but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType an...

CVE-2026-77468

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by config/scramble.php to unauthenticated callers after installation, with observed response size and latency suggesting that the schema is regenerate...

CVE-2026-77470

Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additionaldata array and CheckoutService::preparePurchaseParameters merges it after server-computed purchase parameters. Because later...

CVE-2026-77467

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf. An authenticated user who can upload a small PDF with an oversized...

CVE-2026-61838

Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload and PhotoPolicy::canDownload without first enforcing AlbumPolicy::canAccess. For a public, password-protected album with grantsdownload enabled...

CVE-2026-61611

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::chec...

CVE-2026-62679

Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/path, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default...

CVE-2026-61610

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photosstarvisibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved invokes...

CVE-2026-57569

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.p...

CVE-2026-57568

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allowunsafelinks...

CVE-2026-77466 Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::getsupportedproviders, but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType an...

CVE-2026-77466

The photo-management tool Lychee (prior to version 7.7.0 ) contains a payment bypass vulnerability in its webshop. The root cause is improper input validation in CreateSessionRequest, which fails to enforce OmnipayProviderType::isAllowed() and only checks if the submitted provider is a valid Omni...

EUVD-2026-102197

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::getsupportedproviders, but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType an...

CVE-2026-77466 Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::getsupportedproviders, but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType an...

CVE-2026-77470 Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request

Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additionaldata array and CheckoutService::preparePurchaseParameters merges it after server-computed purchase parameters. Because later...

EUVD-2026-102196

Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additionaldata array and CheckoutService::preparePurchaseParameters merges it after server-computed purchase parameters. Because later...

CVE-2026-77470

The Lychee photo-management tool (prior to version 7.7.1 ) is vulnerable to a parameter tampering flaw in its Supporter or Pro webshop. The POST /api/v2/Shop/Checkout/Process flow allows an unauthenticated buyer to provide an unrestricted additional_data array. Because CheckoutService::preparePur...

CVE-2026-77470 Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request

Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additionaldata array and CheckoutService::preparePurchaseParameters merges it after server-computed purchase parameters. Because later...

CVE-2026-77468

The photo-management tool Lychee is vulnerable to a lack of authentication and resource throttling on the /docs/api endpoint prior to version 7.7.0 . An unauthenticated remote attacker can access Scramble-generated OpenAPI documentation, which appears to regenerate without a cache. By repeatedly ...

CVE-2026-77468 Lychee: Missing Authentication for Critical Function and Allocation of Resources Without Limits or Throttling on /docs/api

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by config/scramble.php to unauthenticated callers after installation, with observed response size and latency suggesting that the schema is regenerate...