CVE-2026-61611: Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks
Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize() permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::check without limiting repeated failures. A remote unauthenticated attacker who knows or can obtain an album identifier can automate password guesses against a password-protected album and, if the password is recovered, gain access to its private photo collection. This issue is fixed in version 7.6.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lycheeto a version that resolves this vulnerability.Fixed in 7.6.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Lychee versions before 7.6.1 are exposed when they host password-protected albums. An attacker must know or obtain the identifier of a protected album to target its unlock endpoint.
Does an attacker need an account or user interaction to exploit it?
No. The unlock request permits any caller to submit password attempts, so exploitation can be performed remotely without authentication or user interaction.
What is the impact if an attacker succeeds?
A successful password guess unlocks the targeted password-protected album, allowing the attacker to access its private photo collection. The issue does not describe impacts beyond access to that album's contents.
What should be done if upgrading cannot happen immediately?
The provided information identifies version 7.6.1 as the fix but does not specify a workaround. Until upgrading, password-protected albums may be subject to automated guessing attempts because the endpoint has no throttling, backoff, CAPTCHA, or lockout.
How can I determine whether my instance is vulnerable?
Check the installed Lychee version. Versions earlier than 7.6.1 have an unlock endpoint without rate limiting or failed-attempt protections.