CVE-2026-61610
Deferred Deferred - Pending Action

Stored XSS in Lychee Photo Management Tool

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photos_star_visibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved() invokes SetPhotosHighlightedRequest::processValidatedValues() before authorization, and PhotoPolicy::canHighlight() returns true for anonymous callers without a canSee check. An unauthenticated attacker who can guess photo identifiers can distinguish existing private photos through differing success and not-found responses and can change their is_highlighted state, including for photos in private or password-protected albums. The issue is limited to installations using the non-default anonymous star-visibility setting. This issue is fixed in version 7.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-61610
EUVD
EUVD-2026-102190

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
LycheeOrg Lychee < 7.6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-61610 is an Insecure Direct Object Reference (IDOR) vulnerability in Lychee, a photo management tool. When the admin setting photos_star_visibility is set to anonymous, unauthenticated users can guess photo IDs to star or highlight private or password-protected photos. The flaw occurs because the app fetches photo data before checking authorization, allowing attackers to determine photo existence via HTTP response codes and modify photo states without permission.

Detection Guidance

Check Lychee version with: curl -s https://your-lychee-instance.com/ | grep -i version. If version is below 7.6.1, the system is vulnerable. Monitor API responses for POST /api/v2/Photo::highlight to detect unauthorized access attempts or inconsistent 404/200 responses for private photos.

Impact Analysis

An unauthenticated attacker could determine if private photos exist by checking for success (200) or not-found (404) responses. They could also change the highlighted status of photos they cannot view, including those in private or password-protected albums. This requires the non-default anonymous star-visibility setting and photo ID guessing.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to private or sensitive photos. If an attacker can guess photo IDs, they may determine the existence of private photos through response differences, which could constitute a data breach under GDPR if personal data is exposed. For HIPAA, if the photos contain protected health information, unauthorized modification of photo visibility could violate confidentiality requirements.

Mitigation Strategies

Upgrade Lychee to version 7.6.1 or later immediately. If upgrading is not possible, disable the anonymous star-visibility setting in admin panel or restrict access to the /api/v2/Photo::highlight endpoint via firewall rules until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61610. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart