PT-2026-31650 · Lychee · Lychee

Published 2026-04-09 · Updated 2026-04-09 · CVE-2026-39957

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Lychee versions prior to 7.5.4

Description A SQL operator-precedence bug in SharingController::listAll() allows authenticated non-admin users with upload permission who own at least one album to retrieve all user-group-based sharing permissions across the entire instance, including private albums owned by other users. The orWhereNotNull('user group id') clause bypasses the ownership filter applied by the when() block.

Recommendations Update to version 7.5.4 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-39957

Affected Products

Lychee

References · 5

• https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-4v4c-g2jv-4g25 · Patch
• https://github.com/LycheeOrg/Lychee/commit/76a3f0513eca6458bf7f8c337c1ad65e59b22bcb · Patch
• https://github.com/LycheeOrg/Lychee/pull/4264 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-39957 · Security Note
• https://twitter.com/CVEnew/status/2042302797845316070 · Twitter Post