CVE-2026-77466

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::get_supported_providers(), but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType and does not enforce OmnipayProviderType::isAllowed(). A buyer, including a guest when webshop_allow_guest_checkout is enabled, can submit Dummy directly and complete the test gateway flow without a real payment. When webshop_auto_fulfill_enabled is enabled, OrderCompletedListener::fullfillOrder() can then release the purchasable item. The issue requires access to the Supporter or Pro webshop and an enabled purchasable item. Testing bypassed the closed-source license middleware, so whether the real license layer performs additional payment-provider validation remains unverified. The payment finalize status check itself is not the root cause. This issue is fixed in version 7.7.0.

• CWE-20
• CWE-184

• https://github.com/LycheeOrg/Lychee/commit/8b73656f920c682862b9199acc87fbaf72ee5a90
• https://github.com/LycheeOrg/Lychee/pull/4507
• https://github.com/LycheeOrg/Lychee/releases/tag/v7.7.0
• https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-5wh2-hg7q-6hv3
• https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-5wh2-hg7q-6hv3

Published

Oct 15, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7745A vulnerability was determined in CodeAstro Online Classroom…6.3
• CVE-2026-77454Incorrect Authorization vulnerability in ash-project ash_sql…5.9
• CVE-2026-77459Argo CD is a declarative, GitOps continuous delivery tool fo…9.9
• CVE-2026-7746A vulnerability was identified in SourceCodester Web-based P…6.3
• CVE-2026-77460EspoCRM is an open source customer relationship management a…6.5
• CVE-2026-77465toml-node is a TOML parser for Node.js and the browser. Prio…7.5
• CVE-2026-77467Lychee is a free, open-source photo-management tool. Prior t…7.1
• CVE-2026-77468Lychee is a free, open-source photo-management tool. Prior t…6.9
• CVE-2026-7747A security flaw has been discovered in Totolink N300RH 3.2.4…9.8
• CVE-2026-77470Lychee is a free, open-source photo-management tool. Prior t…8.3
• CVE-2026-77474destructive_command_guard (dcg) is a command-line safety too…7.1
• CVE-2026-7748A weakness has been identified in Totolink N300RH 3.2.4-B202…8.8