CVE-2026-77470 Details
Description
Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwrite earlier keys, an unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before CheckoutService::processPayment() passes the parameters to a non-PayPal Omnipay gateway. An attacker can therefore make a gateway accept a successful payment for an attacker-selected amount and obtain auto-fulfilled goods while underpaying the merchant. The issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway. This issue is fixed in version 7.7.1.
A vulnerability in Lychee's webshop checkout process prior to version 7.7.1 allows unauthenticated buyers to manipulate the payment amount sent to the gateway. The issue arises because the 'additional_data' array in the checkout request can be used to overwrite server-computed purchase parameters, such as the amount and currency. This manipulation enables attackers to pay significantly less than the actual value of their purchases, while still receiving the purchased items. The vulnerability is present in the Supporter and Pro editions of Lychee, and requires an enabled webshop, a purchasable item, and an affected Omnipay gateway.
To address this vulnerability, update to Lychee version 7.7.1 or later. After updating, ensure that the payment gateway integration is functioning correctly and that the checkout process is not allowing any client-side manipulation of payment amounts.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-476v-jr53-8rxc | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/LycheeOrg/Lychee/commit/24e6e11f1da131ed20b192d7d7b7ca9084451a2f | [email protected] | Source CodeVendor |
| https://github.com/LycheeOrg/Lychee/pull/4514 | [email protected] | Source CodeVendor |
| https://github.com/LycheeOrg/Lychee/releases/tag/v7.7.1 | [email protected] | Release NotesVendor |
| https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-476v-jr53-8rxc | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-472 | External Control of Assumed-Immutable Web Parameter | [email protected] |
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Lychee | <= 7.7.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |