CVE-2026-39957 Details
Description
Lychee is a free, open-source photo-management tool. Prior to 7.5.4, a SQL operator-precedence bug in SharingController::listAll() causes the orWhereNotNull('user_group_id') clause to escape the ownership filter applied by the when() block. Any authenticated non-admin user with upload permission who owns at least one album can retrieve all user-group-based sharing permissions across the entire instance, including private albums owned by other users. This vulnerability is fixed in 7.5.4.
A SQL injection vulnerability has been identified in Lychee versions prior to 7.5.4. The issue arises from a SQL operator-precedence bug in the SharingController's listAll() method, where the orWhereNotNull('user_group_id') clause bypasses the ownership filter. This flaw enables authenticated non-admin users with upload permissions, who own at least one album, to access user-group-based sharing permissions across the platform, including private albums of other users.
Users can update to Lychee version 7.5.4 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LycheeOrg/Lychee/commit/76a3f0513eca6458bf7f8c337c1ad65e59b22bcb | [email protected] | Patch |
| https://github.com/LycheeOrg/Lychee/pull/4264 | [email protected] | Issue TrackingPatch |
| https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-4v4c-g2jv-4g25 | [email protected] | ExploitPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| lycheeorg lychee | < 7.5.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | Initial Analysis | [email protected] |
| Apr 9, 2026 | New CVE Received | [email protected] |