CVE-2026-61611 in Lychee
Summary
by MITRE • 10/15/2026
Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize() permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::check without limiting repeated failures. A remote unauthenticated attacker who knows or can obtain an album identifier can automate password guesses against a password-protected album and, if the password is recovered, gain access to its private photo collection. This issue is fixed in version 7.6.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
Lychee is a widely deployed free and open-source photo-management application that allows users to organize, share, and manage digital media collections. A critical security deficiency was identified in versions prior to 7.6.1 regarding the authentication mechanism for password-protected albums. Specifically, the API endpoint POST /api/v2/Album::unlock lacks essential brute-force protection mechanisms. The implementation does not enforce rate limiting, maintain an attempt counter, implement exponential backoff strategies, utilize CAPTCHA challenges, or trigger account lockouts after repeated failed attempts. This architectural oversight allows any remote unauthenticated actor to submit authentication requests without restriction, provided they possess the album identifier, which is often publicly accessible in shared gallery configurations.
The technical root cause lies within the UnlockAlbumRequest::authorize() method and the subsequent verification logic in app/Actions/Album/Unlock.php. The authorization check permits any caller to initiate the unlock process regardless of previous failure history. Furthermore, the Hash::check function used to validate password guesses operates without integrating with a rate-limiting middleware or session-based tracking system. Consequently, an attacker can programmatically iterate through common passwords using automated tools such as Hydra or custom scripts. Since there is no throttling mechanism to slow down these requests, the attack proceeds at maximum network speed, significantly reducing the time required to recover weak or moderately complex passwords.
From a risk perspective, this vulnerability falls under CWE-307: Improper Restriction of Excessive Authentication Attempts and aligns with MITRE ATT&CK technique T1110: Brute Force. The operational impact is severe for users who rely on album-level password protection to safeguard private or sensitive imagery. If an attacker successfully guesses the password, they gain full access to the contents of that specific album, potentially leading to data exposure and privacy violations. While this does not compromise the entire Lychee instance or other albums, it effectively nullifies the security control intended for individual protected collections. The severity is heightened by the fact that no prior authentication is required to initiate these attempts against public-facing galleries.
To mitigate this vulnerability, administrators must upgrade their Lychee installation to version 7.6.1 or later, where the developers have implemented appropriate rate-limiting and brute-force protection measures. For environments unable to immediately patch due to compatibility constraints, temporary mitigations include placing a reverse proxy such as Nginx or Apache in front of the application to enforce request throttling on the /api/v2/Album::unlock endpoint based on source IP address. Additionally, implementing CAPTCHA services for login endpoints can disrupt automated scripting tools. It is also recommended to enforce strong password policies for album protection and monitor server logs for unusual spikes in authentication failures originating from single sources.