PT-2026-2295 · Lychee · Lychee

Chakradhar1228 · Publicado 2026-01-12 · Atualizado 2026-01-12 · CVE-2026-22784

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Lychee versions prior to 7.1.0

Description Lychee is a free, open-source photo-management tool. A flaw exists in the album password unlock functionality that could allow users to gain unauthorized access to other users' password-protected albums. When a user unlocks a password-protected public album, the system automatically unlocks all other public albums sharing the same password, bypassing authorization controls.

Recommendations Update to version 7.1.0 or later.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-22784

GHSA-JJ56-2C54-4F25

Produtos afetados

Lychee

Referências · 7

• 🔥 https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-jj56-2c54-4f25 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22784.json · Exploit
• https://github.com/LycheeOrg/Lychee/commit/f021a29f9ab2bafa81d9f5e32ff5bc89915c7d41 · Correção
• https://twitter.com/VulmonFeeds/status/2010819616998568053 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2010793677900198080 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-22784 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-22784 · Aviso do Fabricante