Skip to content
OpenAdvisories

Vendor

LycheeOrg

18 known vulnerabilities.

Products

Lychee 18
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Low 2.3
    CVE-2026-61610

    Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous

    Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photos_star_visibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved() …

    LycheeOrg Lychee
  • Low 2.3
    CVE-2026-57569

    Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validation

    Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.p…

    LycheeOrg Lychee
  • Low 2.3
    CVE-2026-39957

    Lychee has Broken Access Control in SharingController::listAll() leaks private album sharing metadata to unauthorized users

    Lychee is a free, open-source photo-management tool. Prior to 7.5.4, a SQL operator-precedence bug in SharingController::listAll() causes the orWhereNotNull('user_group_id') clause to escape the ownership filter applied by the when() block. Any authenticated …

    LycheeOrg Lychee
  • Low 2.3
    CVE-2026-33644

    Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPs

    Lychee is a free, open-source photo-management tool. Prior to version 7.5.2, the SSRF protection in `PhotoUrlRule.php` can be bypassed using DNS rebinding. The IP validation check (line 86-89) only activates when the hostname is an IP address. When a domain n…

    LycheeOrg Lychee
  • Low 2.3
    CVE-2026-22784

    Lychee cross-album password propagation on Album unlocking

    Lychee is a free, open-source photo-management tool. Prior to 7.1.0, an authorization vulnerability exists in Lychee's album password unlock functionality that allows users to gain possibly unauthorized access to other users' password-protected albums. When a…

    LycheeOrg Lychee
  • Low 3.0
    CVE-2025-53018

    Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLs

    Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery (SSRF) vulnerability exists in the `/api/v2/Photo::fromUrl` endpoint. This flaw lets an attacker instruct the application’s backend to make HT…

    LycheeOrg Lychee