Key points
- CVE-2026-61838 affects Lychee versions prior to 7.6.3
- Attackers can bypass password protection on public albums
- Patch is available in version 7.6.3
Lychee photo management tool contains a bypass flaw that allows unauthenticated users to download protected album archives. The issue is resolved in version 7.6.3.
What happened
The National Vulnerability Database records CVE-2026-61838 as a high-severity flaw with a CVSS score of 8.2. The weakness stems from incorrect authorisation logic in the application’s API endpoints. Specifically, the GET /api/v2/Zip route handles album and photo archive requests. It checks whether a user can download content using AlbumPolicy::canDownload() and PhotoPolicy::canDownload(). However, it fails to first verify access rights via AlbumPolicy::canAccess(). This logical gap creates a bypass for authentication controls.
Why it matters
This flaw impacts Lychee installations running versions earlier than 7.6.3. According to the NVD record, an unauthenticated attacker who knows a shared album identifier can exploit this issue. The target album must be public and have the grants_download setting enabled. Normally, browsing endpoints would deny access without the correct password. The vulnerability allows the attacker to skip this step entirely.
They can download a ZIP archive containing the album’s photos. If the grants_full_photo_access setting is enabled, the archive may include full-resolution originals. Associated metadata is also included in the download. This exposes sensitive visual data and personal information linked to the images. The weakness is classified under CWE-285 and CWE-639.
What happens next
- Verify current Lychee version against the 7.6.3 threshold
- Identify public albums with download grants enabled
- Apply the 7.6.3 update to all affected instances
- Monitor logs for unauthorised API access attempts
Patch priority
Teams should prioritise updating systems that host public-facing photo galleries. Check whether any instances allow anonymous downloads of album archives. Isolate affected servers from the internet if immediate patching is not possible. Verify that the update process does not disrupt existing user permissions. Test the new version in a non-production environment first. Ensure backups are current before applying changes. Review access controls for all shared albums after updating. Confirm that password protection is enforced for all download endpoints.
What to do and how to stay safe: Lychee
- Audit all Lychee installations to confirm version numbers
- Restrict public access to albums while waiting for updates
- Monitor server logs for unusual ZIP download requests
- Apply the 7.6.3 patch as soon as testing confirms stability
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Lychee versions are affected by CVE-2026-61838?
All versions prior to 7.6.3 are affected by this vulnerability.
Is there a fix available for this issue?
Yes, the issue is fixed in version 7.6.3 of Lychee.
What can an attacker do with this flaw?
An attacker can download ZIP archives of protected albums without a password.
