CVE-2026-61610
Received Received - Intake

Stored XSS in Lychee Photo Management Tool

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photos_star_visibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved() invokes SetPhotosHighlightedRequest::processValidatedValues() before authorization, and PhotoPolicy::canHighlight() returns true for anonymous callers without a canSee check. An unauthenticated attacker who can guess photo identifiers can distinguish existing private photos through differing success and not-found responses and can change their is_highlighted state, including for photos in private or password-protected albums. The issue is limited to installations using the non-default anonymous star-visibility setting. This issue is fixed in version 7.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-61610
EUVD
EUVD-2026-102190

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
LycheeOrg Lychee < 7.6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-61610 is an Insecure Direct Object Reference (IDOR) vulnerability in Lychee, a photo management tool. When the admin setting photos_star_visibility is set to anonymous, unauthenticated users can guess photo IDs to star or highlight private or password-protected photos. The flaw occurs because the app fetches photo data before checking authorization, allowing attackers to determine photo existence via HTTP response codes and modify photo states without permission.

Detection Guidance

Check Lychee version with: curl -s https://your-lychee-instance.com/ | grep -i version. If version is below 7.6.1, the system is vulnerable. Monitor API responses for POST /api/v2/Photo::highlight to detect unauthorized access attempts or inconsistent 404/200 responses for private photos.

Impact Analysis

An unauthenticated attacker could determine if private photos exist by checking for success (200) or not-found (404) responses. They could also change the highlighted status of photos they cannot view, including those in private or password-protected albums. This requires the non-default anonymous star-visibility setting and photo ID guessing.

Mitigation Strategies

Upgrade Lychee to version 7.6.1 or later immediately. If upgrading is not possible, disable the anonymous star-visibility setting in admin panel or restrict access to the /api/v2/Photo::highlight endpoint via firewall rules until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61610. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart