Read the docs
TI-2026-74841 Aliases CVE-2026-61610

Lychee access control flaw exposes and alters private photos

Priority MEDIUM 51CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Lychee before 7.6.1 has an access control flaw (CWE-284) in its photo highlight API. When photos_star_visibility is set to anonymous, the highlight action changes a photo before checking that the caller can see it. An unauthenticated remote attacker who can guess photo identifiers can tell that private photos exist from differing responses and change their highlight state, including for photos in private or password-protected albums. The issue affects only the non-default anonymous star-visibility setting.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photos_star_visibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved() invokes SetPhotosHighlightedRequest::processValidatedValues() before authorization, and PhotoPolicy::canHighlight() returns true for anonymous callers without a canSee check. An unauthenticated attacker who can guess photo identifiers can distinguish existing private photos through differing success and not-found responses and can change their is_highlighted state, including for photos in private or password-protected albums. The issue is limited to installations using the non-default anonymous star-visibility setting. This issue is fixed in version 7.6.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00306 23rd percentileScored 2026-11-07
Fix Fixed Lychee (LycheeOrg): 7.6.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LycheeOrgLycheebefore 7.6.17.6.1Patch availableCNA
  • Lychee VendorLycheeOrg Affected before 7.6.1 Fixed in 7.6.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:lycheeorg:lychee:*:*:*:*:*:*:*:*——LycheeOrg
  • cpe:2.3:a:lycheeorg:lychee:*:*:*:*:*:*:*:* Versions — — ·LycheeOrg

Remediation

Update Lychee to version 7.6.1, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Lychee (LycheeOrg) Fixed in 7.6.1

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-61610
  2. 2026-10-20 CISA SSVC decision points changed
  3. 2026-10-20 Priority changed: LOW → MEDIUM

References

Other 4

  • TI-2026-74843 Album password bypass in Lychee ZIP downloads CVSS 4.0HIGH 8.2
  • TI-2026-74842 Missing rate limiting in Lychee album unlock allows password guessing CVSS 3.1HIGH 7.5
  • TI-2024-16953 Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote… CVSS 3.1HIGH 8.3
  • TI-2026-74848 Lychee webshop checkout lets buyers override payment amount CVSS 4.0HIGH 8.3
  • TI-2026-74845 Payment bypass in Lychee webshop through unrestricted Dummy gateway CVSS 4.0HIGH 8.3
  • TI-2026-74846 Uncontrolled resource consumption in Lychee PDF processing CVSS 4.0HIGH 7.1
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences