CVE-2026-61611: Lychee Photo Manager Auth Bypass Vulnerability

CVE-2026-61611 Overview

CVE-2026-61611 is a missing rate-limiting vulnerability in Lychee, a free, open-source photo-management application. The flaw affects the POST /api/v2/Album::unlock endpoint, which processes password submissions for password-protected albums. The endpoint lacks throttling, attempt counters, backoff logic, CAPTCHA, and lockout mechanisms. A remote unauthenticated attacker who obtains or guesses an album identifier can automate password-guessing requests to recover the album password. Successful recovery grants access to private photo collections. The issue is classified under CWE-307: Improper Restriction of Excessive Authentication Attempts and is fixed in Lychee version 7.6.1.

Critical Impact

Unauthenticated attackers can brute-force album passwords at machine speed, exposing private photo collections stored in affected Lychee instances.

Affected Products

• Lychee photo-management tool prior to version 7.6.1
• Self-hosted Lychee instances exposing /api/v2/Album::unlock
• Password-protected albums with weak or guessable passwords

Discovery Timeline

• 2026-10-15 - CVE-2026-61611 published to NVD
• 2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-61611

Vulnerability Analysis

Lychee exposes POST /api/v2/Album::unlock to allow users to submit passwords against protected albums. The UnlockAlbumRequest::authorize() method permits any caller, including unauthenticated remote clients, to submit attempts. The handler in app/Actions/Album/Unlock.php validates each submitted password using Hash::check without tracking repeated failures or applying delays between attempts.

The absence of throttling converts a password-protected album into a brute-force target. An attacker who learns an album identifier through shared links, enumeration, or disclosure can automate thousands of password guesses per second against the endpoint. Short, dictionary-based, or reused passwords fall quickly under such automated attacks.

Root Cause

The root cause is the absence of request rate limiting on the unlock route. The vulnerable route definition in routes/api_v2.php registered the endpoint without any throttle middleware, leaving each password submission equally cheap for the attacker. The authorization logic also failed to differentiate between legitimate interactive users and automated clients.

Attack Vector

Exploitation requires network reachability to the Lychee API and knowledge of an album identifier. The attacker scripts repeated POST requests against /api/v2/Album::unlock, iterating through a password list. Because Hash::check returns a deterministic boolean, the attacker can distinguish successful attempts immediately and gain read access to the private photo collection.

 Route::get('/Album::photos', [Gallery\AlbumPhotosController::class, 'get'])->middleware(['login_required:album', 'cache_control']);
 Route::get('/Album::tags', [Gallery\AlbumTagsController::class, 'get'])->middleware(['login_required:album', 'cache_control']);
 Route::get('/Album::getTargetListAlbums', [Gallery\AlbumController::class, 'getTargetListAlbums'])->middleware(['login_required:album', 'cache_control']);
-Route::post('/Album::unlock', [Gallery\AlbumController::class, 'unlock']);
+Route::post('/Album::unlock', [Gallery\AlbumController::class, 'unlock'])->middleware(['throttle:10,1']);
 Route::post('/Album', [Gallery\AlbumController::class, 'createAlbum']);
 Route::patch('/Album', [Gallery\AlbumController::class, 'updateAlbum']);
 Route::patch('/Album::rename', [Gallery\AlbumController::class, 'rename']);

Source: GitHub Commit 592291458a. The patch adds Laravel's throttle:10,1 middleware, capping unlock attempts at 10 requests per minute per client.

Detection Methods for CVE-2026-61611

Indicators of Compromise

• High-frequency POST requests to /api/v2/Album::unlock from a single source IP or small set of IPs
• Repeated failed unlock attempts followed by successful access to a previously protected album
• Access log patterns showing identical album identifiers with varying password payloads
• User-Agent strings associated with HTTP automation tools against the Lychee API

Detection Strategies

• Parse Lychee web server access logs for request rate anomalies against the Album::unlock route
• Alert on more than a threshold of unlock requests per source IP within a short window
• Correlate successful album access events with preceding failed unlock attempts

Monitoring Recommendations

• Enable verbose logging on the Lychee API gateway and ship logs to a centralized SIEM
• Baseline normal unlock request volume per album and alert on deviations
• Monitor for distributed brute-force patterns across multiple source IPs targeting the same album identifier

How to Mitigate CVE-2026-61611

Immediate Actions Required

• Upgrade Lychee to version 7.6.1 or later, which adds the throttle:10,1 middleware to the unlock endpoint
• Enforce strong, high-entropy passwords on all password-protected albums
• Restrict public exposure of the Lychee API to trusted networks where feasible
• Review access logs for signs of past brute-force activity against /api/v2/Album::unlock

Patch Information

The fix is delivered in Lychee Release v7.6.1 via GitHub Pull Request #4448. The patch applies Laravel throttling to limit unlock attempts to 10 per minute. Additional context is available in GitHub Security Advisory GHSA-48vf-fwx6-2ph6.

Workarounds

• Deploy a reverse proxy or web application firewall rule to rate-limit requests to /api/v2/Album::unlock
• Block or challenge clients that exceed a modest request threshold against the unlock endpoint
• Rotate album passwords and consider disabling password-protected sharing until the patch is applied

# Example nginx rate limit for the unlock endpoint
limit_req_zone $binary_remote_addr zone=lychee_unlock:10m rate=10r/m;

location /api/v2/Album::unlock {
    limit_req zone=lychee_unlock burst=5 nodelay;
    proxy_pass http://lychee_backend;
}