Lychee: Payment bypass in webshop via unrestricted Dummy payment gateway
Summary
Lychee, an open-source photo-management tool, has a webshop feature. The test payment provider "Dummy" is hidden from checkout in production, but the server does not enforce this restriction when a session is created. A buyer can select Dummy directly and complete the test gateway flow without a real payment. If automatic fulfilment is enabled, the purchased item can be released. The attack requires access to the Supporter or Pro webshop and an enabled purchasable item, and it is possible for guests when guest checkout is enabled.
Affected
- Lychee versions before 7.7.0 (CNA record: affected < 7.7.0)
- Earliest affected version: unknown (one third-party database lists 7.6.0 as the start of the range)
- Only installations with the webshop enabled are relevant
Fixed in
- Lychee 7.7.0 (vendor advisory GHSA-5wh2-hg7q-6hv3)
- A separate webshop CVE (CVE-2026-77470) is fixed in 7.7.1; install the newest release
Workaround
- No vendor workaround published.
- Interim measure (own assessment, not vendor-verified): disable the webshop, or at least guest checkout and automatic fulfilment, until the update is installed.
Exploitation
- CISA SSVC assessment: exploitation status "poc" (proof of concept exists), automatable: no, technical impact: partial.
- No evidence of in-the-wild exploitation found; CISA KEV listing not confirmed.
- Whether the closed-source license layer adds payment validation is unverified.
Our recommendation
- Check whether the Lychee webshop is enabled on your instances.
- Update to Lychee 7.7.1 or later (at least 7.7.0).
- Until patched, disable guest checkout and automatic fulfilment, or disable the shop.
- Review recent orders for items marked as paid without a matching real payment.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-5wh2-hg7q-6hv3 github.com
- Lychee release v7.7.0 github.com
- Fix commit 8b73656 (Lychee) github.com
- Pull request #4507 (Lychee) github.com
- OSV entry CVE-2026-77466 osv.dev
- Mend record CVE-2026-77466 (Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:41.
Original description (NVD)
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::get_supported_providers(), but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType and does not enforce OmnipayProviderType::isAllowed(). A buyer, including a guest when webshop_allow_guest_checkout is enabled, can submit Dummy directly and complete the test gateway flow without a real payment. When webshop_auto_fulfill_enabled is enabled, OrderCompletedListener::fullfillOrder() can then release the purchasable item. The issue requires access to the Supporter or Pro webshop and an enabled purchasable item. Testing bypassed the closed-source license middleware, so whether the real license layer performs additional payment-provider validation remains unverified. The payment finalize status check itself is not the root cause. This issue is fixed in version 7.7.0.
NVD references (5)
- https://github.com/LycheeOrg/Lychee/commit/8b73656f920c682862b9199acc87fbaf72ee5a90
- https://github.com/LycheeOrg/Lychee/pull/4507
- https://github.com/LycheeOrg/Lychee/releases/tag/v7.7.0
- https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-5wh2-hg7q-6hv3
- https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-5wh2-hg7q-6hv3
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.