Lychee EUVD-2026-102189

Exploitation requires that (1) the Lychee instance (version prior to 7.6.1) has at least one password-protected album configured, and (2) the attacker knows or can obtain that album's identifier. The vulnerable path is POST /api/v2/Album::unlock, which UnlockAlbumRequest::authorize() leaves open to any caller and which lacks any throttle, attempt counter, backoff, CAPTCHA, or lockout. No authentication is required (PR:N) and no user interaction is needed. The practical limiting factor is password strength: a strong, high-entropy album password resists brute-forcing even with unlimited attempts, so realistic impact is concentrated on albums protected by weak or common passwords. Exposure is further limited to instances reachable by the attacker (e.g. internet-facing deployments) and to the contents of the specific unlocked album.

This is a genuine but bounded risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) is internally consistent with the description: a remote, unauthenticated attacker can reach POST /api/v2/Album::unlock over the network with low complexity and no user interaction, and success yields confidentiality-only impact (I:N/A:N) scoped to a single album's photos. The CWE-307 (improper restriction of excessive authentication attempts) classification is well-supported by the source evidence - the fix simply adds throttle:10,1 middleware. No EPSS score, KEV listing, POC, or SSVC data was provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' Importantly, the C:H rating somewhat overstates realistic impact: compromise is not guaranteed by the flaw alone but is contingent on the targeted album's password being weak enough to brute-force, and exposure is limited to that one password-protected album rather than the whole system. So this should be treated as a moderate-priority hardening fix (especially for internet-exposed Lychee instances holding sensitive private albums) rather than a critical, immediately-weaponizable issue. No key signals conflict; the main gap is the absence of EPSS/KEV/POC telemetry to gauge real-world attacker interest.

An attacker discovers or guesses the identifier of a password-protected Lychee album on an internet-facing instance and points an automated script at POST /api/v2/Album::unlock, submitting password guesses as fast as the server accepts them with no lockout or delay. Because Hash::check is invoked on every attempt without an attempt counter or backoff, a weak or common album password is recovered within a feasible number of requests, granting access to the private photo collection. No public exploit was identified at time of analysis, though the attack is trivial to automate with standard HTTP tooling.