Lychee: Album password bypass via ZIP download endpoint
Summary
Lychee, a self-hosted photo management application, does not enforce the album access check on the ZIP download endpoint /api/v2/Zip. For a public, password-protected album with downloads enabled, an unauthenticated attacker who knows the album identifier can download a ZIP archive without the password. If full-photo access is also enabled, the archive contains full-resolution originals and metadata.
Affected
- Lychee versions before 7.6.3 (OSV lists 7.5.4, 7.6.0, 7.6.1 and 7.6.2 explicitly; older versions not verified)
Fixed in
- Lychee 7.6.3 (fix commit 4366dd0e721126dffe29659afec93aee9c1db711)
- The maintainer's same-day advisories are fixed in 7.7.0; upgrading to 7.7.0 or later is recommended
Workaround
- Unknown. No vendor-documented workaround. As a precaution, disable download and full-photo access on password-protected albums where they are not needed.
Exploitation
- No evidence of exploitation in the wild; CISA SSVC lists exploitation as PoC.
- CISA SSVC: Automatable yes, Technical Impact partial.
- KEV listing: not listed according to available sources.
Our recommendation
- Identify all Lychee instances and their versions, and whether they are internet-facing.
- Upgrade to Lychee 7.7.0 or later and verify the release notes before rollout.
- Review password-protected albums with downloads or full-resolution access enabled and disable these flags where not needed.
- Assume that links to such albums may have been used and inform affected clients if data may have been exposed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 4366dd0 (LycheeOrg/Lychee) github.com
- Pull Request #4459 (LycheeOrg/Lychee) github.com
- Lychee release v7.6.3 github.com
- GHSA-735c-2wqc-x29r (GitHub Security Advisory) github.com
- OSV: CVE-2026-61838 osv.dev
- NVD/CNA mirror: CVE-2026-61838 (Vulners) vulners.com
- VulDB entry 420729 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:57.
Original description (NVD)
Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). For a public, password-protected album with grants_download enabled, an unauthenticated attacker who knows the shared album identifier can download a ZIP archive without supplying the password or unlocking the album, even though browsing endpoints deny access. The archive exposes the album's photos and can include full-resolution originals and associated metadata when grants_full_photo_access is enabled. This issue is fixed in version 7.6.3.
NVD references (5)
- https://github.com/LycheeOrg/Lychee/commit/4366dd0e721126dffe29659afec93aee9c1db711
- https://github.com/LycheeOrg/Lychee/pull/4459
- https://github.com/LycheeOrg/Lychee/releases/tag/v7.6.3
- https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-735c-2wqc-x29r
- https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-735c-2wqc-x29r
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.