Key points
- Lychee versions prior to 7.7.0 are affected by CVE-2026-77466, rated High severity.
- Attackers can use the Omnipay Dummy provider to complete purchases without real payment.
- The vulnerability is fixed in Lychee version 7.7.0.
Lychee, an open-source photo management tool, has released version 7.7.0 to address a high-severity flaw in its webshop functionality. The issue allows users to obtain digital items without completing a genuine financial transaction by manipulating the payment provider selection.
What happened
The National Vulnerability Database records CVE-2026-77466 with a CVSS score of 8.3, classifying it as a high-severity issue. The vulnerability stems from insufficient validation in the Lychee webshop component, specifically within the CreateSessionRequest process. According to the source material, the system fails to enforce the OmnipayProviderType::isAllowed() check when processing payment sessions.
In production environments, Lychee is designed to hide the Omnipay Dummy test provider from checkout options via the OmnipayFactory::get_supported_providers() method. However, the backend validation does not strictly prevent a user from submitting 'Dummy' as the chosen provider. This discrepancy allows a buyer to bypass the normal payment flow requirements.
A buyer, including a guest when webshop_allow_guest_checkout is enabled, can submit the Dummy provider directly. This action completes the test gateway flow without requiring actual funds. If the webshop_auto_fulfill_enabled feature is active, the OrderCompletedListener::fullfillOrder() function can then release the purchasable item.
The issue requires access to the Supporter or Pro webshop and an enabled purchasable item. The National Vulnerability Database notes that testing bypassed closed-source license middleware. Consequently, it remains unverified whether the real license layer performs additional payment-provider validation. The root cause is not the payment finalize status check itself, but the lack of provider enforcement.
Why it matters
Organisations using Lychee for digital sales face potential revenue loss if the auto-fulfilment feature is enabled. The ability for specific users to acquire paid content without payment undermines the integrity of the webshop. Security teams must verify their Lychee installations against version 7.7.0 immediately.
The issue is rated high severity with a CVSS score of 8.3. While the closed-source middleware status is unclear, the confirmed vector allows complete bypass of payment requirements under specific conditions. This affects any deployment where purchasable items are enabled and the webshop is accessible.
What happens next
- Update Lychee installations to version 7.7.0 as soon as possible to apply the confirmed fix.
- Audit webshop configurations to identify if guest checkout or auto-fulfilment is currently enabled.
- Review transaction logs for instances where the Dummy provider may have been used successfully.
- Verify that no closed-source middleware updates are pending that might affect payment validation.
Patch priority
Teams should prioritise updating public-facing Lychee instances that have webshop features enabled. Begin with systems where guest checkout is permitted, as these present the broadest attack surface. Verify the current version before rolling out the update to ensure compatibility. Test the patch in a staging environment to confirm that legitimate payment flows remain functional. Back up configuration files prior to the update to allow for rapid rollback if issues arise. Monitor logs for any anomalous activity during the transition period to detect potential exploitation attempts.
What to do and how to stay safe: Lychee
- Check your Lychee version and upgrade to 7.7.0 if you are running an earlier release.
- Disable guest checkout and auto-fulfilment features if you cannot update immediately to reduce exposure.
- Monitor payment logs for transactions involving the Dummy provider or unusual completion patterns.
- Review access controls for the Supporter and Pro webshop tiers to ensure they are properly secured.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Lychee versions are affected by CVE-2026-77466?
All versions of Lychee prior to 7.7.0 are affected by this vulnerability.
Is there a fix available for this vulnerability?
Yes, the issue is fixed in Lychee version 7.7.0.
What is the severity rating of CVE-2026-77466?
The National Vulnerability Database rates it as High with a CVSS score of 8.3.
