PT-2026-2295 · Lychee · Lychee

Chakradhar1228 · Published 2026-01-12 · Updated 2026-01-12 · CVE-2026-22784

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Lychee versions prior to 7.1.0

Description Lychee is a free, open-source photo-management tool. A flaw exists in the album password unlock functionality that could allow users to gain unauthorized access to other users' password-protected albums. When a user unlocks a password-protected public album, the system automatically unlocks all other public albums sharing the same password, bypassing authorization controls.

Recommendations Update to version 7.1.0 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-22784

GHSA-JJ56-2C54-4F25

Affected Products

Lychee

References · 7

• 🔥 https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-jj56-2c54-4f25 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22784.json · Exploit
• https://github.com/LycheeOrg/Lychee/commit/f021a29f9ab2bafa81d9f5e32ff5bc89915c7d41 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22784 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22784 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2010819616998568053 · Twitter Post
• https://twitter.com/CVEnew/status/2010793677900198080 · Twitter Post