CVE-2026-61611
Deferred Deferred - Pending Action

Authentication Bypass in Lychee Photo Management Tool

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize() permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::check without limiting repeated failures. A remote unauthenticated attacker who knows or can obtain an album identifier can automate password guesses against a password-protected album and, if the password is recovered, gain access to its private photo collection. This issue is fixed in version 7.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-61611
EUVD
EUVD-2026-102189

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
LycheeOrg Lychee < 7.6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-61611 is a vulnerability in Lychee, a photo-management tool, affecting versions 7.6.0 and earlier. The POST /api/v2/Album::unlock endpoint lacks rate-limiting or account-lockout mechanisms, allowing brute-force attacks against password-protected albums. Attackers can submit unlimited password attempts without detection or delay.

Detection Guidance

Check for excessive POST requests to /api/v2/Album::unlock. Monitor logs for repeated failed unlock attempts. Use tools like curl to test the endpoint: curl -X POST -d 'albumID=X&password=Y' http://target/api/v2/Album::unlock. High request volumes without delays indicate potential exploitation.

Impact Analysis

An unauthenticated remote attacker can guess weak passwords (e.g., 4-digit PINs) to gain access to private photo collections. The attack is automated and can succeed quickly due to unlimited attempts. Confidentiality of sensitive images is compromised if passwords are recovered.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive photo collections, potentially violating data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., safeguards for protected health information). Unauthorized exposure of personal data may result in compliance breaches, regulatory penalties, or reputational damage.

Mitigation Strategies

Upgrade Lychee to version 7.6.1 or later. If upgrading is not possible, implement rate limiting on the /api/v2/Album::unlock endpoint using Laravel's throttle middleware (e.g., throttle:10,1). Block or monitor IP addresses making excessive requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61611. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart