CVE-2026-77466: Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::getsupportedproviders(), but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType and does not enforce OmnipayProviderType::isAllowed(). A buyer, including a guest when webshopallowguestcheckout is enabled, can submit Dummy directly and complete the test gateway flow without a real payment. When webshopautofulfillenabled is enabled, OrderCompletedListener::fullfillOrder() can then release the purchasable item. The issue requires access to the Supporter or Pro webshop and an enabled purchasable item. Testing bypassed the closed-source license middleware, so whether the real license layer performs additional payment-provider validation remains unverified. The payment finalize status check itself is not the root cause. This issue is fixed in version 7.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lycheeto a version that resolves this vulnerability.Fixed in 7.7.0
Event History
Frequently Asked Questions
Who is exposed to this payment bypass?
Lychee deployments running versions before 7.7.0 are exposed if they have access to the Supporter or Pro webshop, at least one purchasable item enabled, and the Dummy gateway request reaches the vulnerable checkout handling. Guest users can exploit it when webshop_allow_guest_checkout is enabled.
What must an attacker do to exploit the issue?
The attacker must submit the Omnipay Dummy provider directly rather than selecting a normal production checkout provider, then complete the Dummy test-gateway flow. If webshop_auto_fulfill_enabled is enabled, successful completion can automatically release the purchasable item without a real payment.
Are default deployments affected?
The issue depends on webshop functionality and an enabled purchasable item, rather than affecting every Lychee installation. Automatic release additionally depends on webshop_auto_fulfill_enabled; the provided information does not establish the default state of these settings.
What can be done if upgrading is not immediately possible?
Disable purchasable items or the webshop until the installation can be updated, and disable guest checkout to prevent unauthenticated buyers from using the flow. Disable automatic fulfillment to reduce the chance that a completed Dummy flow immediately releases an item.
How can administrators determine whether they need the fix?
Check whether the Lychee version is earlier than 7.7.0 and whether the Supporter or Pro webshop has enabled purchasable items. Review whether guest checkout and automatic fulfillment are enabled, and inspect order or payment records for use of the Dummy provider.