HIGH 8.3 NVD
CVE-2026-77470
Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricte
Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwrite earlier keys, an unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before CheckoutService::processPayment() passes the parameters to a non-PayPal Omnipay gateway. An attacker can therefore make a gateway accept a successful payment for an attacker-selected amount and obtain auto-fulfilled goods while underpaying the merchant. The issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway. This issue is fixed in version 7.7.1.
References
- https://github.com/LycheeOrg/Lychee/commit/24e6e11f1da131ed20b192d7d7b7ca9084451a2f
- https://github.com/LycheeOrg/Lychee/pull/4514
- https://github.com/LycheeOrg/Lychee/releases/tag/v7.7.1
- https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-476v-jr53-8rxc
- https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-476v-jr53-8rxc
This high severity vulnerability with a CVSS score of 8.3 was published on 2026-10-15 via NVD.
vulnfeed aggregates 14677 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.