Lychee
CVE-2026-22784
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 4.3 (MEDIUM). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None. Exploitation no authentication required. Public exploit/POC available. |
| Exploit ScenarioDerived | An attacker without authentication could exploit this vulnerability to gain possibly unauthorized access to other users' password-protected albums. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Lychee photo management tool versions before 7.1.0 contain an authorization bypass in the album password unlock mechanism that allows authenticated users to access multiple password-protected albums by unlocking just one that shares the same password. Public exploit code exists for this vulnerability. Administrators should upgrade to version 7.1.0 or later to prevent unauthorized access to protected photo collections.
Earlier versions of this analysis (1)
Lychee is a free, open-source photo-management tool. Prior to 7.1.0, an authorization vulnerability exists in Lychee's album password unlock functionality that allows users to gain possibly unauthorized access to other users' password-protected albums. [CVSS 4.3 MEDIUM]
RemediationAI
A vendor patch is available — apply it immediately. Fixed in version 7.1.0.. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-863 (Incorrect Authorization). Affects Lychee. Lychee is a free, open-source photo-management tool. Prior to 7.1.0, an authorization vulnerability exists in Lychee's album password unlock functionality that allows users to gain possibly unauthorized access to other users' password-protected albums. When a user unlocks a password-protected public album, the system automatically unlocks ALL other public albums that share the same password, resulting in a complete authorization bypass. This vulnerability is fixed in 7.1.0.
Know when Lychee gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Lychee is a free, open-source photo-management tool. Prior to 7.1.0, an authorization vulnerability exists in Lychee's album password unlock functionality that allows users to gain possibly unauthorized access to other users' password-protected albums. When a user unlocks a password-protected public album, the system automatically unlocks ALL other public albums that share the same password, resulting in a complete authorization bypass. This vulnerability is fixed in 7.1.0.
Executive ViewAI
Organizations using Lychee should be aware of moderate risk from CVE-2026-22784, a incorrect authorization vulnerability rated CVSS 4.3. Attackers could gain access beyond their authorized level. Proof-of-concept code is publicly available. A patch is available and should be applied during regular vulnerability management.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)GitHub Advisory
Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary co
Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain s
Lychee is a free photo-management tool. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Authenticated path traversal in Lychee photo-management tool prior to 7.6.4 allows any logged-in user to read files acce
Paid fulfillment bypass in Lychee (Supporter/Pro editions) before 7.7.0: the checkout validators accept any OmnipayProvi
Unauthenticated buyers on Lychee instances running the Supporter/Pro webshop can tamper with the parameters handed to th
Unauthenticated attackers who know the shared identifier of a public, password-protected Lychee album can pull down a ZI
Lychee photo-management instances running versions prior to 7.6.1 expose POST /api/v2/Album::unlock with no throttle, at
Denial of service in Lychee before 7.7.0 allows an authenticated user with upload/import permission to tie up image-proc
Unauthenticated remote attackers can retrieve a complete OpenAPI schema and repeatedly force CPU-intensive schema regene
Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php. Rated medium severit
Stored cross-site scripting in Lychee photo-management software (all versions prior to 7.6.0) allows an authenticated us
Exploit-DB