CVE-2026-77466
Received Received - Intake

Test Gateway Bypass in Lychee Photo Management

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::get_supported_providers(), but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType and does not enforce OmnipayProviderType::isAllowed(). A buyer, including a guest when webshop_allow_guest_checkout is enabled, can submit Dummy directly and complete the test gateway flow without a real payment. When webshop_auto_fulfill_enabled is enabled, OrderCompletedListener::fullfillOrder() can then release the purchasable item. The issue requires access to the Supporter or Pro webshop and an enabled purchasable item. Testing bypassed the closed-source license middleware, so whether the real license layer performs additional payment-provider validation remains unverified. The payment finalize status check itself is not the root cause. This issue is fixed in version 7.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-77466
EUVD
EUVD-2026-102197

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
LycheeOrg Lychee < 7.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-184 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77466 is a vulnerability in Lychee, a photo-management tool, where an attacker can bypass payment by exploiting the Dummy test payment gateway. The UI hides this option in production, but the backend does not enforce this restriction during payment processing. An attacker can manually select the Dummy gateway, process a test payment with a valid test card, and receive purchased items without actual payment.

Detection Guidance

To detect this vulnerability, check if Lychee versions 7.6.4 or earlier are installed. Verify if the Dummy payment gateway is accessible in production mode by inspecting the checkout provider options or backend validation logic. Review payment session creation and finalization logs for unauthorized Dummy gateway usage.

Impact Analysis

This vulnerability allows attackers to obtain purchasable items for free by exploiting the Dummy payment gateway. It requires access to the Supporter or Pro webshop and an enabled purchasable item. If webshop_auto_fulfill_enabled is enabled, the item may be automatically delivered without payment. The exploit does not require admin privileges.

Mitigation Strategies

Upgrade Lychee to version 7.7.0 or later to apply the security fix. Ensure the Dummy payment gateway is restricted in production by validating provider types using OmnipayProviderType::isAllowed() in CreateSessionRequest and OmnipayFactory. Disable guest checkout if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77466. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart