LycheeOrg Lychee up to 7.7.0 Checkout Process preparePurchaseParameters additional_data input validation

Summaryinfo

A vulnerability was found in LycheeOrg Lychee up to 7.7.0. It has been rated as critical. The impacted element is the function CheckoutService::preparePurchaseParameters of the file /api/v2/Shop/Checkout/Process of the component Checkout. Performing a manipulation of the argument additional_data results in input validation. This vulnerability is known as CVE-2026-77470. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, was found in LycheeOrg Lychee up to 7.7.0. This affects the function CheckoutService::preparePurchaseParameters of the file /api/v2/Shop/Checkout/Process of the component Checkout. The manipulation of the argument additional_data with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on integrity, and availability. The summary by CVE is:

Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwrite earlier keys, an unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before CheckoutService::processPayment() passes the parameters to a non-PayPal Omnipay gateway. An attacker can therefore make a gateway accept a successful payment for an attacker-selected amount and obtain auto-fulfilled goods while underpaying the merchant. The issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway. This issue is fixed in version 7.7.1.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-77470 since 08/20/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 7.7.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• LycheeOrg

Name

• Lychee

Version

• 7.0
• 7.1
• 7.2
• 7.3
• 7.4
• 7.5
• 7.6
• 7.7.0

Website

• Product: https://github.com/LycheeOrg/Lychee/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion