CVE-2026-61610: Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous
Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photosstarvisibility is set to anonymous, POST /api/v2/Photo::highlight can fetch and modify a photo without confirming that the caller can see it. BaseApiRequest::validateResolved() invokes SetPhotosHighlightedRequest::processValidatedValues() before authorization, and PhotoPolicy::canHighlight() returns true for anonymous callers without a canSee check. An unauthenticated attacker who can guess photo identifiers can distinguish existing private photos through differing success and not-found responses and can change their ishighlighted state, including for photos in private or password-protected albums. The issue is limited to installations using the non-default anonymous star-visibility setting. This issue is fixed in version 7.6.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lycheeto a version that resolves this vulnerability.Fixed in 7.6.1
Event History
Frequently Asked Questions
Which installations are affected?
Only Lychee installations configured with photos_star_visibility set to anonymous are affected. The issue is limited to this non-default setting and affects versions prior to 7.6.1.
What does an attacker need to exploit this issue?
An attacker does not need to authenticate, but must be able to guess photo identifiers. They can use differing success and not-found responses to determine whether private photos exist, then alter the is_highlighted state of existing photos.
Can private or password-protected album photos be affected?
Yes. The vulnerable endpoint can modify the highlighted state of photos in private and password-protected albums even when the caller is not permitted to view them.
What should be done if upgrading is not immediately possible?
Change photos_star_visibility away from anonymous, since the issue is limited to installations using that setting. Upgrade to Lychee 7.6.1 when possible.