Lychee EUVD-2026-102197

Requires a Lychee Supporter or Pro edition instance running the webshop with at least one enabled purchasable item. The free-item release specifically requires webshop_auto_fulfill_enabled to be turned on so OrderCompletedListener::fullfillOrder() auto-releases the item; the unauthenticated guest path additionally requires webshop_allow_guest_checkout to be enabled (otherwise a registered buyer account is needed). These are non-default, paid-edition and opt-in configuration flags, which materially limits the exploitable population. A further unverified limit: the closed-source license middleware was bypassed during testing, so the real license layer may perform extra payment-provider validation that blocks this on genuinely licensed deployments.

This is a genuine but conditional integrity flaw, not a drive-by critical. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 8.3 (High) and models the attack honestly: network-reachable and unauthenticated for the guest path, but with AT:P (Attack Requirements: Present) reflecting that specific webshop configuration must be in place. The primary impact is VI:H (integrity) - a buyer obtains a purchasable item without real payment - with only VC:L confidentiality and no availability impact, so this is a fraud/revenue-loss issue rather than a system-compromise or RCE issue. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation status is 'no public exploit identified at time of analysis'; the only public artifacts are the vendor advisory, fix commit, and PR diff, which describe the flaw but are not weaponized exploit code. The main caveat the vendor states explicitly: testing bypassed the closed-source license middleware, so whether the production license layer performs additional payment-provider validation remains UNVERIFIED - meaning real-world exploitability on a licensed Supporter/Pro instance is not fully confirmed. Overall priority is moderate: easy to trigger where conditions are met, but gated behind paid-edition webshop deployment and specific config flags, limiting the population of exploitable targets.

On a Lychee Supporter/Pro instance running the webshop with guest checkout enabled, an attacker (or any guest buyer) starts a checkout session and directly submits the hidden 'Dummy' Omnipay test provider, which CreateSessionRequest accepts because it checks only that the value is a valid OmnipayProviderType and never calls isAllowed(). The attacker completes the fake test-gateway flow with no real payment, and if webshop_auto_fulfill_enabled is set, OrderCompletedListener::fullfillOrder() releases the purchasable item for free. No exploit code is public; the attack requires only crafted checkout requests and is network-reachable without authentication on the guest path.