LycheeOrg has 10 CVEs on record. Disclosure cadence is accelerating: 10 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 10. The median CVSS is 7.3 (high). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.3
- Publish → KEV
- —
- Last 90 days
- 10 prev 0
Worst active — by depth score
CVE-2026-77470High· 8.3Lychee is a free, open-source photo-management tool58CVE-2026-77466High· 8.3Lychee is a free, open-source photo-management tool58CVE-2026-61838High· 8.2Lychee is a free, open-source photo-management tool57CVE-2026-62679High· 8.9Lychee is a free, open-source photo-management tool49CVE-2026-61611High· 7.5Lychee is a free, open-source photo-management tool41
LycheeOrg vulnerabilities
CVEs affecting LycheeOrg, newest first. Open any entry for full detail, references, and exploit status.
10 CVEsRSS
CVE-2026-77470High· 8.3PoCLychee is a free, open-source photo-management tool
Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merg…
CVE-2026-77468Medium· 6.9Lychee is a free, open-source photo-management tool
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by config/scramble.php to unauthenticated callers after installation, with observed respon…
CVE-2026-77467High· 7.1Lychee is a free, open-source photo-management tool
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an effective pre-render limit to PDF page dimensions in ImagickHandler::loadPdf(). An authent…
CVE-2026-77466High· 8.3PoCLychee is a free, open-source photo-management tool
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::get_supported_providers(), but CreateSessionRequest validat…
CVE-2026-62679High· 8.9Lychee is a free, open-source photo-management tool
Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/{path}, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before ca…
CVE-2026-61838High· 8.2PoCLychee is a free, open-source photo-management tool
Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). …
CVE-2026-61611High· 7.5Lychee is a free, open-source photo-management tool
Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize() permits any caller to submit attempts, and ap…
CVE-2026-61610Low· 2.3Lychee is a free, open-source photo-management tool
Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photos_star_visibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiReques…
CVE-2026-57569Low· 2.3PoCLychee is a free, open-source photo-management tool
Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Ac…
CVE-2026-57568Medium· 5.7Lychee is a free, open-source photo-management tool
Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables…