LycheeOrg Lychee up to 7.6.0 Photo Highlighting Authorization /api/v2/Photo canHighlight photos_star_visibility improper authorization

Summaryinfo

A vulnerability classified as critical was found in LycheeOrg Lychee up to 7.6.0. Affected by this vulnerability is the function PhotoPolicy::canHighlight of the file /api/v2/Photo of the component Photo Highlighting Authorization. Such manipulation of the argument photos_star_visibility leads to improper authorization. This vulnerability is listed as CVE-2026-61610. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in LycheeOrg Lychee up to 7.6.0 and classified as critical. Affected by this issue is the function PhotoPolicy::canHighlight of the file /api/v2/Photo of the component Photo Highlighting Authorization. The manipulation of the argument photos_star_visibility with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photos_star_visibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved() invokes SetPhotosHighlightedRequest::processValidatedValues() before authorization, and PhotoPolicy::canHighlight() returns true for anonymous callers without a canSee check. An unauthenticated attacker who can guess photo identifiers can distinguish existing private photos through differing success and not-found responses and can change their is_highlighted state, including for photos in private or password-protected albums. The issue is limited to installations using the non-default anonymous star-visibility setting. This issue is fixed in version 7.6.1.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-61610 since 07/10/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading to version 7.6.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• LycheeOrg

Name

• Lychee

Version

• 7.0
• 7.1
• 7.2
• 7.3
• 7.4
• 7.5
• 7.6.0

Website

• Product: https://github.com/LycheeOrg/Lychee/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion