CVE-2026-77470
Deferred Deferred - Pending Action

Price Manipulation in Lychee Photo Management Tool

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwrite earlier keys, an unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before CheckoutService::processPayment() passes the parameters to a non-PayPal Omnipay gateway. An attacker can therefore make a gateway accept a successful payment for an attacker-selected amount and obtain auto-fulfilled goods while underpaying the merchant. The issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway. This issue is fixed in version 7.7.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-77470
EUVD
EUVD-2026-102196

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
LycheeOrg Lychee < 7.7.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-472 The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77470 is a payment amount tampering flaw in Lychee's webshop checkout process. The vulnerability allows an unauthenticated attacker to override the legitimate order total by submitting a manipulated amount through the additional_data parameter. The server computes the correct order total but then merges untrusted client input, letting the attacker set an arbitrary amount like €0.01 instead of the correct €35.27.

Detection Guidance

To detect this vulnerability, check if your Lychee instance is running a version prior to 7.7.1. Use commands like 'curl -s https://your-lychee-instance.com/version' or inspect the version in the admin panel. If the version is below 7.7.1, the system is vulnerable.

Impact Analysis

If you are a merchant using Lychee's webshop, an attacker could underpay for goods while still receiving them if auto-fulfilment is enabled. This results in financial loss for the merchant. If you are a user, your payment amount could be manipulated to charge less than intended.

Compliance Impact

This vulnerability could lead to financial loss for merchants and unauthorized access to goods, which may violate data protection and financial compliance requirements under standards like GDPR (data integrity) and HIPAA (financial transaction security). The improper handling of payment amounts and potential exposure of sensitive transaction data could result in non-compliance with these regulations.

Mitigation Strategies

Immediately upgrade Lychee to version 7.7.1 or later. If upgrading is not possible, disable the webshop feature or restrict access to the checkout endpoint. Review payment gateway logs for suspicious transactions where amounts were manipulated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77470. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart