Lychee EUVD-2026-20954

Despite the low CVSS score of 2.3, this vulnerability carries moderate real-world risk due to multiple factors. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network accessibility with low complexity and authentication requirements (PR:L), meaning any authenticated user with basic upload permissions can exploit it without user interaction. The AT:P (Attacker Threat) modifier and VC:L (Confidentiality Loss) indicate restricted exploitation conditions and limited confidentiality impact. However, the information disclosed-sharing permissions across an entire photo management instance-could enable secondary attacks such as targeted harassment, privacy violation planning, or further reconnaissance for privilege escalation. The low CVSS reflects that the vulnerability requires authenticated access and produces information-disclosure rather than system-level compromise. This is a classic case where CVSS underrates practical impact: while system integrity and availability are unaffected, the exposure of metadata about user-group sharing relationships in a privacy-sensitive photo-sharing tool represents a meaningful organizational risk. Real-world priority should be elevated above the CVSS score suggests, particularly for multi-user Lychee deployments in privacy-conscious environments.

An authenticated non-admin user with standard upload permissions who manages at least one personal album crafts a request to the sharing API endpoint, triggering SharingController::listAll(). Due to the SQL operator-precedence bug, the query returns not only their own sharing records but also all user-group-based sharing permissions across the entire Lychee instance, including private albums owned by other users. The attacker gains unintended visibility into which user groups have access to sensitive albums, potentially enabling social engineering or privacy-violation planning without requiring administrative credentials or additional technical exploitation.