Authorization Flaw in Lychee Photo Management Tool Allows Unauthenticated Access
CVE-2026-61610

2.3LOW

Key Information:

Vendor

Lycheeorg

Status
Lychee
Vendor
CVE Published:
15 October 2026

What is CVE-2026-61610?

Lychee, an open-source photo-management tool, possesses an authorization flaw that allows unauthenticated users to fetch and modify photos when certain settings are enabled. Specifically, if the 'photos_star_visibility' is set to anonymous, the API endpoint /api/v2/Photo::highlight can be exploited. This occurs because the validation process does not adequately check whether the caller has permission to view a particular photo, permitting unauthorized changes to be made to the 'is_highlighted' state of photos, including those in private or password-protected albums. Attackers can leverage this flaw to deduce the existence of private photos and manipulate their visibility by guessing photo identifiers. The vulnerability is addressed in Lychee version 7.6.1.

Affected Version(s)

Lychee < 7.6.1

References

https://github.com/LycheeOrg/Lychee/security/advisories/G...
x_refsource_CONFIRM
https://github.com/LycheeOrg/Lychee/pull/4449
x_refsource_MISC
https://github.com/LycheeOrg/Lychee/commit/fe07567c176bbd...
x_refsource_MISC

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.