CVE-2026-77470 - Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request
CVE ID :CVE-2026-77470 Published : Oct. 15, 2026, 5:17 p.m. | 16 minutes ago Description :Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and...