CVE-2026-61611 LycheeOrg CVE debrief

Who should care

Defenders managing Lychee installations, especially those with publicly accessible album unlock endpoints, should assess exposure and implement compensating controls. They should verify exposure, implement rate limiting or IP blocking for album unlock attempts, and monitor for suspicious album unlock activity. Prioritizing upgrades to version 7.6.1 or later is also recommended.

Why it matters

CVE-2026-61611 is a high-severity vulnerability in Lychee that allows for brute-force attacks on album password unlock endpoints. Defenders should verify exposure, implement compensating controls, and prioritize upgrading to version 7.6.1 or later.

• Verify exposure of Lychee installations to public album unlock endpoints
• Implement rate limiting or IP blocking for album unlock attempts
• Monitor for suspicious album unlock activity

Technical summary

The Lychee photo-management tool has a vulnerability (CVE-2026-61611) in its album password unlock endpoint, allowing for brute-force attacks due to missing rate limiting. This issue was fixed in version 7.6.1. A remote unauthenticated attacker who knows or can obtain an album identifier can automate password guesses against a password-protected album and, if the password is recovered, gain access to its private photo collection. Defenders should prioritize verifying exposure and implementing compensating controls for Lychee installations, especially those with publicly accessible album unlock endpoints.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls for Lychee installations, especially those with publicly accessible album unlock endpoints.

Recommended defensive actions

• Verify Lychee installation version and exposure to public album unlock endpoints
• Implement rate limiting or IP blocking for album unlock attempts
• Monitor for suspicious album unlock activity
• Upgrade to Lychee version 7.6.1 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and the fix in version 7.6.1. However, there is limited information on actual exploitation or affected deployments. Defenders should verify exposure, implement compensating controls, and prioritize upgrading to version 7.6.1 or later. The vulnerability allows for brute-force attacks on album password unlock endpoints, and defenders should assess exposure and implement compensating controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.