CVE-2026-61611

Publié : 15 octobre 2026

Modifié : 15 octobre 2026

Score CVSS

7.5

HIGH

Description détaillée

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize() permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::check without limiting repeated failures. A remote unauthenticated attacker who knows or can obtain an album identifier can automate password guesses against a password-protected album and, if the password is recovered, gain access to its private photo collection. This issue is fixed in version 7.6.1.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Références et Patchs

https://github.com/LycheeOrg/Lychee/commit/592291458a3373114a21412956fd23cfcda32aba https://github.com/LycheeOrg/Lychee/pull/4448 https://github.com/LycheeOrg/Lychee/releases/tag/v7.6.1 https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-48vf-fwx6-2ph6

Dernières Vulnérabilités

CVE-2026-110378

Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ninja Forms Signature Contract Add-On: from n/a through 3.2.5.

VOIR DÉTAILS

CVE-2026-110375

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3.

VOIR DÉTAILS

CVE-2026-110374

Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login with phone number: from n/a through 1.8.77.

VOIR DÉTAILS