CVE-2026-61610

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photos_star_visibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved() invokes SetPhotosHighlightedRequest::processValidatedValues() before authorization, and PhotoPolicy::canHighlight() returns true for anonymous callers without a canSee check. An unauthenticated attacker who can guess photo identifiers can distinguish existing private photos through differing success and not-found responses and can change their is_highlighted state, including for photos in private or password-protected albums. The issue is limited to installations using the non-default anonymous star-visibility setting. This issue is fixed in version 7.6.1.

• CWE-284

• https://github.com/LycheeOrg/Lychee/commit/fe07567c176bbdcda7b276bb6d664dfcd47a9b00
• https://github.com/LycheeOrg/Lychee/pull/4449
• https://github.com/LycheeOrg/Lychee/releases/tag/v7.6.1
• https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-qcqq-p4pq-7r77
• https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-qcqq-p4pq-7r77

Published

Oct 15, 2026

Last Modified

Oct 20, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61605Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-61606Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-61607Grav API Plugin is a RESTful API for Grav CMS that provides …4.6
• CVE-2026-61608SolidInvoice is an open-source invoicing platform. Prior to …6.8
• CVE-2026-61609Pterodactyl is a free, open-source game server management pa…7.5
• CVE-2026-6161A vulnerability was determined in code-projects Simple ChatB…7.3
• CVE-2026-61611Lychee is a free, open-source photo-management tool. Prior t…7.5
• CVE-2026-61612CKAN MCP Server is a tool for querying CKAN open data portal…5.7
• CVE-2026-61613Cursor is a code editor built for programming with AI. Prior…7.7
• CVE-2026-61614SolidInvoice is an open-source invoicing platform. Prior to …5.9
• CVE-2026-61617Wings is the server control plane for the Pterodactyl game-s…7.7
• CVE-2026-61618SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5…6.9