Lychee: Payment amount manipulation in webshop checkout

Summary

Lychee is a self-hosted photo-management tool with an optional webshop for Supporter and Pro users. In affected versions, an unauthenticated buyer can send extra data in the checkout request that overwrites server-computed payment parameters such as amount, currency, returnUrl, cancelUrl or transactionId. If an affected non-PayPal Omnipay gateway is used, the attacker can pay a smaller amount and still receive auto-fulfilled goods. The attack requires an enabled webshop with a purchasable item and an affected gateway.

Affected

• Lychee versions prior to 7.7.1 with the webshop enabled
• Exact affected version range: conflicting sources; treat all versions below 7.7.1 as affected until the vendor advisory confirms it
• Affected Omnipay gateways: Unknown (the description only says non-PayPal gateways)

Fixed in

• Lychee 7.7.1 (commit 24e6e11)

Workaround

• No vendor workaround known.
• Disabling the webshop until 7.7.1 is installed removes the attack path (inference from the preconditions, not a vendor recommendation).

Exploitation

• No evidence of exploitation in the wild found.
• No public proof of concept found.
• CISA SSVC: exploitation poc, not automatable.
• EPSS 0.00451 (low).

Our recommendation

• Update Lychee to version 7.7.1 or later as soon as possible.
• If you cannot update right away, disable the webshop.
• Check whether your Lychee instances are reachable from the internet and whether the webshop is enabled.
• Review recent webshop orders for amounts that do not match the item prices and for unusual payment gateway transactions.
• Note that the fix was public before the CVE was published, so check older instances now.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-476v-jr53-8rxc github.com
• Fix commit 24e6e11 github.com
• Pull Request #4514 github.com
• Lychee release v7.7.1 github.com
• GitHub Security overview Lychee github.com
• OpenCVE CVE-2026-77470 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:42.