SQL Operator-Precedence Bug in Lychee Photo Management Tool

CVE-2026-39957

What is CVE-2026-39957?

A vulnerability in the Lychee photo management tool arises from a SQL operator-precedence error in the SharingController::listAll() function. This flaw allows authenticated non-admin users with upload permissions, who own at least one album, to bypass ownership filters and gain access to user-group-based sharing permissions across the instance, including private albums belonging to other users. The issue stems from the improper handling of SQL clauses, making it possible for unauthorized access to sensitive data within the application. This vulnerability has been addressed in version 7.5.4 and it is recommended for users to update their installations to ensure security.

References