CVE-2026-61611
7.5HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-307
Impact
Remote unauthenticated attackers can brute-force password-protected album credentials and view private photos. They only need network access to the Lychee instance and a known or discovered album identifier.
Root cause
The POST /api/v2/Album::unlock endpoint checks passwords without rate limiting, attempt tracking, backoff delays, or lockouts.
Affected systems
Lychee versions prior to 7.6.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Upgrade Lychee to version 7.6.1 or later. If patching immediately is not possible, apply rate limiting at your reverse proxy (such as Nginx or Cloudflare) specifically for POST requests targeting /api/v2/Album::unlock.
$ git fetch --tags && git checkout v7.6.1AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize() permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::check without limiting repeated failures. A remote unauthenticated attacker who knows or can obtain an album identifier can automate password guesses against a password-protected album and, if the password is recovered, gain access to its private photo collection. This issue is fixed in version 7.6.1.