CVE-2026-39957: Lychee has Broken Access Control in SharingController::listAll() leaks private album sharing metadata to unauthorized users
Lychee is a free, open-source photo-management tool. Prior to 7.5.4, a SQL operator-precedence bug in SharingController::listAll() causes the orWhereNotNull('usergroupid') clause to escape the ownership filter applied by the when() block. Any authenticated non-admin user with upload permission who owns at least one album can retrieve all user-group-based sharing permissions across the entire instance, including private albums owned by other users. This vulnerability is fixed in 7.5.4.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39957?
CVE-2026-39957 has a medium severity rating due to its potential for leaking private album sharing metadata.
How do I fix CVE-2026-39957?
To fix CVE-2026-39957, upgrade Lychee to version 7.5.4 or later.
What versions of Lychee are affected by CVE-2026-39957?
Lychee versions prior to 7.5.4 are affected by CVE-2026-39957.
What kind of vulnerability is CVE-2026-39957?
CVE-2026-39957 is categorized as a broken access control vulnerability.
What impact does CVE-2026-39957 have on users?
CVE-2026-39957 allows unauthorized users to access private album sharing metadata.