CVE-2026-77470
Severity not reportedLychee is a free, open-source photo-management tool.
Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwrite earlier keys, an unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before CheckoutService::processPayment() passes the parameters to a non-PayPal Omnipay gateway. An attacker can therefore make a gateway accept a successful payment for an attacker-selected amount and obtain auto-fulfilled goods while underpaying the merchant. The issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway. This issue is fixed in version 7.7.1.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/LycheeOrg/Lychee/commit/24e6e11f1da131ed20b192d7d7b7ca9084451a2f security-advisories@github.com
- https://github.com/LycheeOrg/Lychee/pull/4514 security-advisories@github.com
- https://github.com/LycheeOrg/Lychee/releases/tag/v7.7.1 security-advisories@github.com
- https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-476v-jr53-8rxc security-advisories@github.com
- https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-476v-jr53-8rxc 134c704f-9b21-4f2e-91b3-4a467353bcc0