CVE-2026-61838: Lychee Photo Management Auth Bypass Flaw

CVE-2026-61838 Overview

Lychee, an open-source photo-management application, contains a broken access control flaw in versions prior to 7.6.3. The GET /api/v2/Zip endpoint authorizes archive downloads through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first invoking AlbumPolicy::canAccess(). An unauthenticated attacker who knows the shared identifier of a public, password-protected album with grants_download enabled can retrieve a ZIP archive without supplying the password. When grants_full_photo_access is enabled, the archive exposes full-resolution originals and associated metadata. The weakness is tracked as [CWE-285: Improper Authorization].

Critical Impact
Unauthenticated attackers can download password-protected album contents, including original photos and metadata, by guessing or discovering the album identifier.

Affected Products

Lychee photo-management tool, all versions prior to 7.6.3
Deployments using password-protected public albums with grants_download enabled
Instances with grants_full_photo_access enabled are at elevated risk of original-image exposure

Discovery Timeline

2026-10-15 - CVE-2026-61838 published to NVD
2026-10-15 - Last updated in NVD database
Fix released - Lychee version 7.6.3 published on GitHub (Lychee Release v7.6.3)

Technical Details for CVE-2026-61838

Vulnerability Analysis

The flaw is a classic broken access control condition in the archive download path. Lychee's standard browsing endpoints correctly reject access to password-protected albums until the visitor unlocks them. The ZIP endpoint takes a different code path and never calls the gating check. As a result, authorization logic that depends on prior access evaluation runs with an incorrect assumption. The visitor is treated as authorized to download because the album is public and downloads are permitted, even though the album has not been unlocked.

Root Cause

The AlbumPolicy::canDownload() method evaluates download permission in isolation from the album access state. There is no preceding call to canAccess(), which is the function responsible for enforcing password unlock, link-sharing checks, and visibility rules. The missing precondition allows the download policy to return true for any public album configured with grants_download, regardless of whether the requester satisfied the password gate.

Attack Vector

Exploitation requires only network reach to the Lychee instance and knowledge of the shared album identifier. The attacker issues an unauthenticated GET /api/v2/Zip request referencing the album ID. The server builds and returns the ZIP without password validation. If grants_full_photo_access is set, the archive contains original resolution images and embedded EXIF metadata.

php

// Patch excerpt from app/Policies/AlbumPolicy.php
// Source: https://github.com/LycheeOrg/Lychee/commit/4366dd0e721126dffe29659afec93aee9c1db711

			return $config_manager->getValueAsBool('grants_download');
		}

+		// Check if user can access the album first.
+		if (!$this->canAccess($user, $abstract_album)) {
+			return false;
+		}
+
		// User is logged in
		// Or User can download.
		if (!$abstract_album instanceof BaseAlbum) {

The patch inserts an explicit canAccess() guard so that canDownload() denies the request whenever the requester has not satisfied album access requirements.

Detection Methods for CVE-2026-61838

Indicators of Compromise

Web server access logs containing GET /api/v2/Zip requests from unauthenticated sessions targeting password-protected album IDs
ZIP download responses to clients that never issued a successful album unlock request
Anomalous outbound bandwidth from the Lychee host corresponding to full-album archive sizes

Detection Strategies

Correlate /api/v2/Zip requests against prior successful unlock events for the same album identifier and session; flag archives served without a matching unlock
Baseline normal download volume per album and alert on unauthenticated clients retrieving multiple protected album archives
Review reverse proxy or WAF logs for high-rate enumeration of album identifiers followed by Zip endpoint hits

Monitoring Recommendations

Enable verbose request logging on the Lychee application and forward logs to a centralized analytics platform
Track response sizes on /api/v2/Zip and alert on sustained large transfers to external IPs
Monitor for scanners probing /api/v2/ paths against public-facing Lychee deployments

How to Mitigate CVE-2026-61838

Immediate Actions Required

Upgrade Lychee to version 7.6.3 or later as published in the Lychee Release v7.6.3
Audit album configuration and disable grants_download on password-protected albums until the upgrade is applied
Review web server and application logs for prior unauthorized access to the /api/v2/Zip endpoint

Patch Information

The fix is included in Lychee 7.6.3 and implemented in commit 4366dd0 through pull request #4459. Full disclosure details are published in GitHub Security Advisory GHSA-735c-2wqc-x29r.

Workarounds

Temporarily disable grants_download on all password-protected albums until patching completes
Disable grants_full_photo_access to limit exposure of original-resolution images and metadata
Restrict access to the Lychee instance behind a VPN or authenticated reverse proxy where feasible
Block unauthenticated requests to /api/v2/Zip at the WAF or reverse proxy layer

bash

# Example NGINX rule to require authentication on the Zip endpoint
location /api/v2/Zip {
    auth_request /auth/validate;
    proxy_pass http://lychee_backend;
}