CVE-2026-61838: Lychee: Album password bypass in ZIP downloads
Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). For a public, password-protected album with grantsdownload enabled, an unauthenticated attacker who knows the shared album identifier can download a ZIP archive without supplying the password or unlocking the album, even though browsing endpoints deny access. The archive exposes the album's photos and can include full-resolution originals and associated metadata when grantsfullphotoaccess is enabled. This issue is fixed in version 7.6.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lycheeto a version that resolves this vulnerability.Fixed in 7.6.3
Event History
Frequently Asked Questions
Which Lychee albums are exposed to this bypass?
Public, password-protected albums are exposed when downloads are enabled through grants_download. The attacker must know the shared album identifier; private albums are not identified as affected by the available information.
What does an attacker need to exploit the issue?
No authentication, album password, or prior album unlock is required. The attacker only needs the shared identifier for an affected album and can request its ZIP archive.
What data can the unauthorized ZIP download contain?
The archive exposes the album's photos. If grants_full_photo_access is enabled, it can also include full-resolution originals and associated metadata.
What should be done if upgrading cannot happen immediately?
Disable downloads for public password-protected albums by turning off grants_download. Also avoid enabling grants_full_photo_access where exposure of originals or metadata would be unacceptable.
How can I determine whether an instance is vulnerable?
Versions before 7.6.3 are affected. Review public password-protected albums for grants_download, then test whether their ZIP download endpoint returns an archive without authentication or the album password.