CVE-2026-61610 Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photosstarvisibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved invokes...

CVE-2026-61610

The photo-management tool Lychee is vulnerable to an improper access control issue in versions prior to 7.6.1 . When photos_star_visibility is set to anonymous, the POST /api/v2/Photo::highlight endpoint fails to verify if a caller has permission to see a photo before processing the request. Spec...