CVE-2026-77466 LycheeOrg CVE debrief

Who should care

Defenders managing Lychee installations, especially those with enabled webshops and purchasable items, should assess exposure and prioritize verification and potential remediation.

Why it matters

CVE-2026-77466 is a high-severity vulnerability in Lychee that allows buyers to bypass payment by using the Dummy gateway. Defenders managing Lychee installations, especially those with enabled webshops and purchasable items, should assess exposure and prioritize verification and potential remediation.

• Potential unauthorized release of purchasable items when webshop_auto_fulfill_enabled is enabled.
• Possible bypass of payment validation for Dummy gateway in webshop transactions.
• Need for verification of exposure in Lychee deployments with webshops and purchasable items.
• Potential impact on revenue and inventory management due to unauthorized transactions.

Technical summary

The vulnerability in Lychee allows a buyer to bypass payment by submitting the Omnipay Dummy test provider directly. This is possible because CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType and does not enforce OmnipayProviderType::isAllowed(). The issue requires access to the Supporter or Pro webshop and an enabled purchasable item. The payment bypass can lead to unauthorized release of purchasable items when webshop_auto_fulfill_enabled is enabled. Defenders should prioritize verifying exposure and assessing the need for compensating controls, especially in environments with enabled webshops and purchasable items.

Defensive priority

Defenders should prioritize verifying exposure and assessing the need for compensating controls, especially in environments with enabled webshops and purchasable items.

Recommended defensive actions

• Verify if the Lychee installation is affected by checking the version and configuration.
• Assess the need for compensating controls, especially in environments with enabled webshops and purchasable items.
• Update to version 7.7.0 or later to fix the vulnerability.
• Monitor for potential abuse of the Dummy gateway in webshop transactions.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and fixed version. However, the extent of exploitation and potential impact on specific deployments remain unverified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.