CVE-2026-77470
Lychee is a free, open-source photo-management tool
- Risk score
- 62/100
- CVSS
- 8.3 v4.0
- Exploit chance (30 days)
- 0.5%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwri…
- Affected
- See advisory
- Fix
- Upgrade the product to 7.7.1 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.3 high
- Remotely exploitable without logging in
References
- https://github.com/LycheeOrg/Lychee/commit/24e6e11f1da131ed20b192d7d7b7ca9084451a2f
- https://github.com/LycheeOrg/Lychee/pull/4514
- https://github.com/LycheeOrg/Lychee/releases/tag/v7.7.1
- https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-476v-jr53-8rxc
- https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-476v-jr53-8rxc
Original description
Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwrite earlier keys, an unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before CheckoutService::processPayment() passes the parameters to a non-PayPal Omnipay gateway. An attacker can therefore make a gateway accept a successful payment for an attacker-selected amount and obtain auto-fulfilled goods while underpaying the merchant. The issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway. This issue is fixed in version 7.7.1.
Last activity 15 Oct 2026. Patch Forecast updates every hour.