Unrestricted Data Handling in Lychee's Webshop Process by LycheeOrg

CVE-2026-77470

What is CVE-2026-77470?

Lychee, an open-source photo management tool, is susceptible to an improper input validation issue within its webshop API before version 7.7.1. The vulnerability arises when the webshop allows an unrestricted additional_data array that can be manipulated by an unauthenticated user. Specifically, this leads to potential overwriting of critical parameters such as amount, currency, returnUrl, cancelUrl, and transactionId during the checkout process via the CheckoutService. An attacker exploiting this flaw could orchestrate a scenario where they process payments for goods at unauthorized amounts, resulting in auto-fulfilled transactions without proper payment—affecting both the merchant and consumer trust. It is essential to upgrade to version 7.7.1 or later to secure your system against this flaw.

References