Authorization Bypass in Lychee Photo Management Tool
CVE-2026-22784

2.3LOW

Key Information:

Vendor

Lycheeorg

Status
Lychee
Vendor
CVE Published:
12 January 2026

What is CVE-2026-22784?

Lychee, an open-source photo management tool, experienced an authorization vulnerability that allowed users to bypass security measures on password-protected albums. Prior to version 7.1.0, when a user successfully unlocked one password-protected public album, all other albums sharing the same password became accessible without proper authorization. This flaw posed significant risks of unauthorized access to user content. The issue has been addressed in the 7.1.0 release, which mitigates the vulnerabilities associated with the album unlock functionality.

Affected Version(s)

Lychee < 7.1.0

References

https://github.com/LycheeOrg/Lychee/security/advisories/G...
x_refsource_CONFIRM
https://github.com/LycheeOrg/Lychee/commit/f021a29f9ab2ba...
x_refsource_MISC

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.