Unauthorized Access in Lychee Photo Management Tool
CVE-2026-61838

8.2HIGH

Key Information:

Vendor

Lycheeorg

Status
Lychee
Vendor
CVE Published:
15 October 2026

What is CVE-2026-61838?

Lychee, an open-source photo management solution, has a vulnerability in its API that allows unauthenticated attackers to access and download ZIP archives of photo albums. This occurs due to insufficient access control checks in the AlbumPolicy and PhotoPolicy components. An attacker with knowledge of the album identifier can exploit this flaw to download archived photos without proper authorization, significantly risking the exposure of private albums, their content, and related metadata. This issue has been addressed and resolved in version 7.6.3 of the software.

Affected Version(s)

Lychee < 7.6.3

References

https://github.com/LycheeOrg/Lychee/security/advisories/G...
x_refsource_CONFIRM
https://github.com/LycheeOrg/Lychee/pull/4459
x_refsource_MISC
https://github.com/LycheeOrg/Lychee/commit/4366dd0e721126...
x_refsource_MISC

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.