CVE-2026-61838 LycheeOrg CVE debrief

Who should care

System administrators and security teams responsible for photo management systems, especially those using Lychee, should assess their deployment contexts for potential exposure and prioritize upgrading to version 7.6.3 or later.

Why it matters

CVE-2026-61838 is a high-severity vulnerability in Lychee that allows unauthorized ZIP downloads from public, password-protected albums. Defenders should prioritize verifying exposure and upgrading to version 7.6.3 or later. System administrators and security teams responsible for photo management systems should assess their deployment contexts for potential exposure.

• Potential unauthorized access to sensitive photos and metadata.
• Possible exposure of full-resolution originals when grants_full_photo_access is enabled.
• Need to verify exposure and upgrade to version 7.6.3 or later.
• Potential for monitoring and logging to detect suspicious activity.

Technical summary

The vulnerability in Lychee allows an unauthenticated attacker to download a ZIP archive of a public, password-protected album without supplying the password or unlocking the album. This is possible because the AlbumPolicy::canDownload() and PhotoPolicy::canDownload() methods do not first enforce AlbumPolicy::canAccess(). The issue is fixed in version 7.6.3. Affected product deployments should be identified, and defenders should prioritize verifying exposure and upgrading to version 7.6.3 or later. System administrators and security teams responsible for photo management systems should assess their deployment contexts for potential exposure.

Defensive priority

Defenders should prioritize verifying exposure and upgrading to version 7.6.3 or later. System administrators and security teams responsible for photo management systems should assess their deployment contexts for potential exposure.

Recommended defensive actions

• Verify if the Lychee installation is exposed to the internet or untrusted networks.
• Check if the installed version is earlier than 7.6.3 and upgrade if necessary.
• Review album configurations to ensure that only authorized users have access.
• Monitor for suspicious activity related to album downloads.
• Track exceptions and retest remediated assets.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and the fixed version. However, additional information on potential exploitation or affected systems is limited. Defenders should verify exposure by checking if the Lychee installation is exposed to the internet or untrusted networks and review album configurations to ensure that only authorized users have access. They should also monitor for suspicious activity related to album downloads and consider compensating controls for exposed systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.