EUVD-2026-102196Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach unauthenticated Checkout/Process API
-
DeliveryInject additional_data overriding amount/currency
-
ExploitLater keys overwrite server-computed params
-
ExecutionGateway approves attacker-chosen underpayment
-
ImpactObtain auto-fulfilled goods, defraud merchant
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Requires a Lychee instance with the Supporter/Pro webshop feature enabled, at least one purchasable item configured, and a non-PayPal Omnipay payment gateway in use (PayPal is explicitly not affected). No authentication is required (PR:N) and no user interaction is needed, but the vulnerable code path only exists when these webshop conditions are met; the additional_data array must contain keys (amount, currency, returnUrl, cancelUrl, transactionId) that collide with and overwrite the server-computed purchase parameters during CheckoutService::preparePurchaseParameters(). The limiting factor is the opt-in, non-default webshop deployment plus gateway type, which sharply narrows the exposed population. |
| Impact | This is a credible, prioritizable business-logic flaw rather than an inflated high-CVSS issue. The official CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, base 8.3) shows a network-reachable, low-complexity, unauthenticated flaw whose primary impact is high integrity (VI:H) with minor confidentiality (VC:L) and no availability impact - consistent with a mass-assignment/parameter-override that lets a buyer dictate the charged amount. The AT:P (attack requirement 'Present') and the description's stated prerequisites (enabled webshop, a purchasable item, an affected non-PayPal Omnipay gateway) are the key tempering factors: this only affects Lychee instances actively running the paid Supporter/Pro webshop, which is an opt-in, non-default deployment. A proof-of-concept exploit is confirmed to exist (the fixing PR #4514 ships tests/Webshop/Checkout/PocAmountOverrideTest.php demonstrating client-controlled amount override), so publicly available exploit code exists. No EPSS score was provided in the input and the CVE is not listed in CISA KEV, so there is no evidence of widespread or active exploitation - exploitation is plausible but would be limited to the subset of Lychee operators with a live webshop. Net: real and actionable for anyone running the Lychee webshop, but narrow in blast radius because of the required feature set. |
| Exploit ScenarioDerived | An attacker browses to a Lychee instance that has the Supporter/Pro webshop enabled with a purchasable item and a non-PayPal Omnipay gateway configured. Without authenticating, they submit POST /api/v2/Shop/Checkout/Process with valid card data plus an additional_data array that overrides the server-computed amount (and optionally currency/returnUrl/transactionId), causing the gateway to approve a drastically reduced payment while Lychee auto-fulfills the goods. A working proof-of-concept exists in the vendor fix PR (#4514). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Unauthenticated buyers on Lychee instances running the Supporter/Pro webshop can tamper with the parameters handed to the payment gateway, overriding the server-computed amount, currency, returnUrl, cancelUrl, or transactionId so that a gateway approves a payment for an attacker-chosen price while the merchant is underpaid and auto-fulfilled goods are still delivered. The flaw lives in CheckoutService::preparePurchaseParameters(), which merges the client-supplied additional_data array after the server's own purchase parameters, allowing later string keys to overwrite earlier ones before processPayment() reaches a non-PayPal Omnipay gateway. Exploitation is not a network-wide exposure: it requires an enabled webshop, at least one purchasable item, and an affected Omnipay gateway (PayPal is explicitly not affected), which sharply narrows the population at risk; no public exploit code was identified at time of analysis, though the upstream fix ships a regression test that demonstrates the parameter override, and no CISA KEV entry exists. This is best treated as a credible, prioritizable business-logic flaw rather than an inflated high-severity issue, since the integrity impact on the merchant's billing is real but the prerequisites are opt-in and non-default.
RemediationAI
Vendor-released patch: 7.7.1 - upgrade Lychee to v7.7.1 or later (release https://github.com/LycheeOrg/Lychee/releases/tag/v7.7.1, fixing PR https://github.com/LycheeOrg/Lychee/pull/4514, commit 24e6e11f1da131ed20b192d7d7b7ca9084451a2f), which strips any additional_data keys that already exist in the server-computed $params before merging so client input can no longer overwrite amount, currency, returnUrl, cancelUrl, or transactionId; the patch also bumps the internal config version to 070701 and clears the application cache, so operators should run the database migration and verify the configured version after upgrading. If an immediate upgrade is not possible, the most effective compensating control is to disable the webshop entirely, which fully removes the vulnerable code path at the cost of losing storefront functionality; a narrower alternative is to restrict the webshop to PayPal as the sole Omnipay gateway, since the advisory states PayPal is explicitly not affected and re-derives the charge server-side, though this changes the merchant's payment-provider mix and may carry its own commercial constraints. Operators who must leave a non-PayPal gateway live should temporarily restrict access to POST /api/v2/Shop/Checkout/Process (for example at the reverse proxy or WAF) to trusted networks or add server-side reconciliation that compares the gateway-reported captured amount against the order's server-computed total before auto-fulfilment, accepting that reconciliation adds manual review overhead and does not prevent the malformed request from reaching the gateway. Regardless of mitigation, review recent webshop orders for underpayment anomalies until the upgrade is in place, and consult the vendor advisory https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-476v-jr53-8rxc for any updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Lychee is a PHP/Laravel photo-management application, and the affected component is its optional Supporter/Pro webshop, which uses the Omnipay payment-abstraction library to talk to multiple gateways. The root-cause class is CWE-20 (Improper Input Validation): CheckoutService::preparePurchaseParameters() builds a server-authoritative $params array (amount, currency, returnUrl, cancelUrl, transactionId) and then overlays the request's unrestricted additional_data array on top of it. Because PHP array merging lets later string keys replace earlier ones, any key the attacker supplies that collides with a server-computed key wins, and the poisoned array is subsequently passed by CheckoutService::processPayment() into the Omnipay gateway's purchase() call. The vulnerability is therefore a parameter-injection/price-tampering issue, not a memory-safety or injection-in-the-classic-sense bug, and it is gateway-dependent: Omnipay integrations that re-derive amounts server-side or that ignore client-supplied fields (notably PayPal) are explicitly not affected. One cross-source note: the supplied tag set labels this as 'Information Disclosure', which does not reflect the actual integrity/business-logic nature of the flaw - the CVSS vector and independent assessment both point to integrity (I:H) with only limited confidentiality exposure. Per the CPE (cpe:2.3:a:lycheeorg:lychee:*:*:*:*:*:*:*:*), all Lychee builds before 7.7.1 carry the vulnerable code path.
Know when Lychee gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Network, unauthenticated, no interaction; AC:H reflects required non-default webshop/gateway configuration; impact is integrity (price tampering) with minor confidentiality and no availability effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwrite earlier keys, an unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before CheckoutService::processPayment() passes the parameters to a non-PayPal Omnipay gateway. An attacker can therefore make a gateway accept a successful payment for an attacker-selected amount and obtain auto-fulfilled goods while underpaying the merchant. The issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway. This issue is fixed in version 7.7.1.
Technical POC Analysis
Improper input validation (CWE-20 as assigned; the advisory also maps CWE-472 External Control of Assumed-Immutable Web Parameter and CWE-915 Improperly Controlled Modification of Dynamically-Determi…
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Lychee instances running the Supporter/Pro webshop with an affected non-PayPal Omnipay payment gateway are exposed to a high-severity payment-tampering flaw (CVSS 8.3) that can let a buyer alter checkout parameters so the gateway approves an attacker-chosen amount while the merchant is underpaid and auto-fulfilled goods are still delivered. This creates a revenue-integrity and order-fulfillment risk for affected merchants, though exposure requires an enabled webshop, at least one purchasable item, and an affected gateway; PayPal is explicitly not affected. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis, so leadership should prioritize interim controls and transaction monitoring for affected storefronts.
Disable the webshop or affected non-PayPal Omnipay gateway, switch to PayPal where supported, strip or reject client-supplied additional_data before processPayment, enforce server-side payment amount/currency/URL/transaction ID validation, reconcile gateway approvals to order totals, and monitor for auto-fulfillment mismatches. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary co
Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain s
Lychee is a free photo-management tool. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Authenticated path traversal in Lychee photo-management tool prior to 7.6.4 allows any logged-in user to read files acce
Lychee photo management tool versions before 7.1.0 contain an authorization bypass in the album password unlock mechanis
Paid fulfillment bypass in Lychee (Supporter/Pro editions) before 7.7.0: the checkout validators accept any OmnipayProvi
Unauthenticated attackers who know the shared identifier of a public, password-protected Lychee album can pull down a ZI
Lychee photo-management instances running versions prior to 7.6.1 expose POST /api/v2/Album::unlock with no throttle, at
Denial of service in Lychee before 7.7.0 allows an authenticated user with upload/import permission to tie up image-proc
Unauthenticated remote attackers can retrieve a complete OpenAPI schema and repeatedly force CPU-intensive schema regene
Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php. Rated medium severit
Stored cross-site scripting in Lychee photo-management software (all versions prior to 7.6.0) allows an authenticated us
Exploit-DB