Vulnerability in Lychee Photo Management Tool by LycheeOrg
CVE-2026-77466

8.3HIGH

Key Information:

Vendor

Lycheeorg

Status
Lychee
Vendor
CVE Published:
15 October 2026

What is CVE-2026-77466?

The Lychee photo management tool, prior to version 7.7.0, contains a vulnerability that improperly validates payment providers during checkout. Specifically, the Omnipay Dummy test provider is hidden in production environments, yet users, including guests, can submit it directly when certain configurations are enabled. This allows them to bypass real payment validation and complete the checkout process without actual payments. As a result, this can lead to unauthorized access to purchasable items configured for the Supporter or Pro versions of the webshop. The vulnerability has been addressed in version 7.7.0.

Affected Version(s)

Lychee < 7.7.0

References

https://github.com/LycheeOrg/Lychee/security/advisories/G...
x_refsource_CONFIRM
https://github.com/LycheeOrg/Lychee/pull/4507
x_refsource_MISC
https://github.com/LycheeOrg/Lychee/commit/8b73656f920c68...
x_refsource_MISC

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.