What is the CVSS score of CVE-2026-22784?

CVE-2026-22784 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Lychee are affected by CVE-2026-22784?

Organizations using Lychee should be aware of moderate risk from CVE-2026-22784, a incorrect authorization vulnerability rated CVSS 4.3. Attackers could gain access beyond their authorized level.. A patch is available.

Is there a public PoC exploit available for CVE-2026-22784?

Yes, a public proof-of-concept exploit is available for CVE-2026-22784. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-22784?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Lychee CVE-2026-22784

MEDIUM

Incorrect Authorization (CWE-863)

2026-01-12 security-advisories@github.com

Authentication Bypass Lychee Lycheeorg

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 16, 2026 - 18:39 vuln.today

Public exploit code

Patch released

Jan 16, 2026 - 18:39 nvd

Patch available

CVE Published

Jan 12, 2026 - 19:16 nvd

MEDIUM 4.3

DescriptionGitHub Advisory

Lychee is a free, open-source photo-management tool. Prior to 7.1.0, an authorization vulnerability exists in Lychee's album password unlock functionality that allows users to gain possibly unauthorized access to other users' password-protected albums. When a user unlocks a password-protected public album, the system automatically unlocks ALL other public albums that share the same password, resulting in a complete authorization bypass. This vulnerability is fixed in 7.1.0.

AnalysisAI

Lychee photo management tool versions before 7.1.0 contain an authorization bypass in the album password unlock mechanism that allows authenticated users to access multiple password-protected albums by unlocking just one that shares the same password. Public exploit code exists for this vulnerability. Administrators should upgrade to version 7.1.0 or later to prevent unauthorized access to protected photo collections.

Technical ContextAI

Classified as CWE-863 (Incorrect Authorization). Affects Lychee. Lychee is a free, open-source photo-management tool. Prior to 7.1.0, an authorization vulnerability exists in Lychee's album password unlock functionality that allows users to gain possibly unauthorized access to other users' password-protected albums. When a user unlocks a password-protected public album, the system automatically unlocks ALL other public albums that share the same password, resulting in a complete authorization bypass. This vulnerability is fixed in 7.1.0.