LycheeOrg Lychee vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20252
3. 202615

Newest CVEs

• CVE-2026-77466

  Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection

  LycheeOrg · Lychee

  High8.3
• CVE-2026-77470

  Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request

  LycheeOrg · Lychee

  High8.3
• CVE-2026-77468

  Lychee: Missing Authentication for Critical Function and Allocation of Resources Without Limits or Throttling on /docs/api

  LycheeOrg · Lychee

  Medium6.9
• CVE-2026-77467

  Lychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing path

  LycheeOrg · Lychee

  High7.1
• CVE-2026-62679

  Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read

  LycheeOrg · Lychee

  High8.9
• CVE-2026-61838

  Lychee: Album password bypass in ZIP downloads

  LycheeOrg · Lychee

  High8.2
• CVE-2026-61610

  Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous

  LycheeOrg · Lychee

  Low2.3
• CVE-2026-61611

  Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks

  LycheeOrg · Lychee

  High7.5
• CVE-2026-57569

  Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validation

  LycheeOrg · Lychee

  Low2.3
• CVE-2026-57568

  Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)

  LycheeOrg · Lychee

  Medium5.7