CVE-2026-61838 Lychee: Album password bypass in ZIP downloads
Unauthenticated attackers can bypass password protection to download ZIP archives of protected albums in Lychee photo management software.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-61838?
CVE-2026-61838 is a high-severity authentication bypass vulnerability in LycheeOrg Lychee, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). For a public, password-protected album with grants_download enabled, an unauthenticated attacker who knows the shared album identifier can download a ZIP archive without supplying the password or unlocking the album, even though browsing endpoints deny access. The archive exposes the album's photos and can include full-resolution originals and associated metadata when grants_full_photo_access is enabled. This issue is fixed in version 7.6.3.
Which versions are affected by CVE-2026-61838?
How do I fix CVE-2026-61838?
No fix has been published for CVE-2026-61838 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-61838 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61838 exists.
Sources
Also known as GHSA-735c-2wqc-x29r.