CVE-2026-61838High· 8.2▾ MidnightPoC availableLychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 45.1 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.4%
Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). For a public, password-protected album with grants_download enabled, an unauthenticated attacker who knows the shared album identifier can download a ZIP archive without supplying the password or unlocking the album, even though browsing endpoints deny access. The archive exposes the album's photos and can include full-resolution originals and associated metadata when grants_full_photo_access is enabled. This issue is fixed in version 7.6.3.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77470High· 8.3Lychee is a free, open-source photo-management tool
CVE-2026-77466High· 8.3Lychee is a free, open-source photo-management tool
CVE-2026-77467High· 7.1Lychee is a free, open-source photo-management tool
CVE-2026-57569Low· 2.3Lychee is a free, open-source photo-management tool
CVE-2026-61610Low· 2.3Lychee is a free, open-source photo-management tool
CVE-2026-113643Medium· 4.3EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization