Remote Code Execution Vulnerability in Lychee Photo Management Tool

CVE-2026-61611

What is CVE-2026-61611?

Lychee, a free and open-source photo management tool, has a vulnerability that allows remote unauthenticated attackers to exploit the Album unlock feature. This weakness results from the absence of throttling mechanisms, such as attempt counters, backoff strategies, CAPTCHA, or account lockout features in the POST /api/v2/Album::unlock endpoint. Attackers can repeatedly guess passwords for protected albums without limitations. If successful, they can access private photo collections. This issue has been resolved in version 7.6.1, which implements necessary security measures to prevent unauthorized access.

References