CVE-2026-77467

In Lychee before 7.7.1, the POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array that is merged after server-computed purchase parameters. An unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before passing to an Omnipay gateway, allowing underpayment and acquisition of goods.

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by config/scramble.php to unauthenticated callers after installation, with observed response size and latency suggesting that the schema is regenerated without an application-level cache. A remote attacker can repeatedly request the unthrottled route to consume server CPU and obtain a detailed map of the API surface and parameter schema.

In Lychee before 7.7.0, the hidden Omnipay Dummy test provider can be used by a buyer (including a guest) by submitting it directly, as CreateSessionRequest does not enforce OmnipayProviderType::isAllowed(). This allows completing the test gateway flow without a real payment and releasing the purchasable item if auto-fulfillment is enabled.

In Lychee before 7.6.4, SecurePathController serving GET /image/{path} concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under a specific non-default configuration, any authenticated user can read files outside the intended directory, including application configuration and other users' private images.

In Lychee before 7.6.3, the GET /api/v2/Zip endpoint authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). For a public, password-protected album with grants_download enabled, an unauthenticated attacker who knows the album identifier can download a ZIP archive without supplying the password.

In Lychee before 7.6.1, the POST /api/v2/Album::unlock endpoint has no throttle, attempt counter, backoff, CAPTCHA, or lockout. A remote unauthenticated attacker who knows the album identifier can automate password guesses against a password-protected album and gain access to its private photo collection.

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photos_star_visibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved() invokes SetPhotosHighlightedRequest::processValidatedValues() before authorization, and PhotoPolicy::canHighlight() returns true for anonymous callers without a canSee check. An unauthenticated attacker who can guess photo identifiers can distinguish existing private photos through differing success and not-found responses and can change their is_highlighted state, including for photos in private or password-protected albums. The issue is limited to installations using the non-default anonymous star-visibility setting. This issue is fixed in version 7.6.1.

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.php for a separate fopen connection. An authenticated attacker who controls DNS responses can cause validation to observe a public address and the subsequent fetch to resolve the same hostname to a private or otherwise forbidden address. This DNS rebinding time-of-check to time-of-use mismatch bypasses the intended server-side request forgery protections and can reach services available from the Lychee server, subject to deployment and TLS behavior. This issue is fixed in version 7.6.0.

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allow_unsafe_links. PreformattedPhotoData.php and PreFormattedAlbumData.php convert the description to HTML, and gallery components render that HTML with v-html, so a visitor clicking the rendered link executes attacker-controlled JavaScript in the Lychee origin.

The lychee link checking action for Markdown, HTML, and text files prior to version 2.0.2 contains a potential arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0.2.