CVE-2026-77466

8.3High

Published 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.3High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on integrity
Weakness: CWE-20, CWE-184

Impact

Attackers can bypass payment checks and obtain purchased items for free. They need network access to an active Supporter or Pro webshop with purchasable items, and can trigger it as an unauthenticated guest if guest checkout is enabled.

Root cause

CreateSessionRequest only checks that a requested provider is an OmnipayProviderType without validating OmnipayProviderType::isAllowed(), letting clients manually supply the test Dummy provider.

Affected systems

Lychee versions prior to 7.7.0

CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix & remediation

Upgrade Lychee to 7.7.0 or higher. As a temporary workaround, disable webshop_auto_fulfill_enabled or disable webshop_allow_guest_checkout.

shell

$ git pull && composer install --no-dev

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::get_supported_providers(), but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType and does not enforce OmnipayProviderType::isAllowed(). A buyer, including a guest when webshop_allow_guest_checkout is enabled, can submit Dummy directly and complete the test gateway flow without a real payment. When webshop_auto_fulfill_enabled is enabled, OrderCompletedListener::fullfillOrder() can then release the purchasable item. The issue requires access to the Supporter or Pro webshop and an enabled purchasable item. Testing bypassed the closed-source license middleware, so whether the real license layer performs additional payment-provider validation remains unverified. The payment finalize status check itself is not the root cause. This issue is fixed in version 7.7.0.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-77466