CVE-2026-61610 LycheeOrg CVE debrief

Who should care

Defenders responsible for Lychee installations, especially those using the non-default anonymous star-visibility setting, should assess exposure and prioritize verification and remediation.

Why it matters

This vulnerability allows an unauthenticated attacker to distinguish and modify private photos in Lychee installations with the non-default anonymous star-visibility setting. Defenders should prioritize verification, remediation, and monitoring.

• An unauthenticated attacker can distinguish existing private photos through differing success and not-found responses.
• An unauthenticated attacker can change the highlighted state of photos, including those in private or password-protected albums.
• Defenders need to verify and upgrade to version 7.6.1 or later if the anonymous star-visibility setting is used.
• Defenders should monitor for unusual activity related to photo starring.

Technical summary

The vulnerability allows an unauthenticated attacker to fetch and modify a photo without confirming that the caller can see it when photos_star_visibility is set to anonymous. This issue arises from a flawed validation process in the BaseApiRequest::validateResolved() method, which invokes SetPhotosHighlightedRequest::processValidatedValues() before proper authorization. Consequently, an attacker can exploit this weakness to distinguish existing private photos through differing success and not-found responses. The issue also allows attackers to change the is_highlighted state of photos, including those in private or password-protected albums. This vulnerability is limited to installations using the non-default,

Defensive priority

Defenders should prioritize verifying and upgrading to version 7.6.1 or later if the anonymous star-visibility setting is used, and monitor for unusual activity related to photo starring.

Recommended defensive actions

• Verify and upgrade Lychee to version 7.6.1 or later if the anonymous star-visibility setting is used.
• Monitor for unusual activity related to photo starring.
• Review and adjust the star-visibility setting according to security requirements.
• Conduct a thorough review of existing photo albums and access controls.
• Implement additional monitoring to detect potential exploitation attempts.
• Consider temporarily disabling the star feature until the upgrade can be applied.
• Review and update incident response plans to address potential exploitation.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its impact on installations with the non-default anonymous star-visibility setting. However, there is limited information on actual exploitation or affected deployments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.