CVE-2026-61610

The photo-management tool Lychee is vulnerable to an improper access control issue in versions prior to 7.6.1 . When photos_star_visibility is set to anonymous, the POST /api/v2/Photo::highlight endpoint fails to verify if a caller has permission to see a photo before processing the request. Spec...