Authorization Bypass in Lychee Photo Management Tool

CVE-2026-22784

What is CVE-2026-22784?

Lychee, an open-source photo management tool, experienced an authorization vulnerability that allowed users to bypass security measures on password-protected albums. Prior to version 7.1.0, when a user successfully unlocked one password-protected public album, all other albums sharing the same password became accessible without proper authorization. This flaw posed significant risks of unauthorized access to user content. The issue has been addressed in the 7.1.0 release, which mitigates the vulnerabilities associated with the album unlock functionality.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References