CVE ID :CVE-2026-61838 Published : Oct. 15, 2026, 5:17 p.m. | 16 minutes ago Description :Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first...

#Sicherheitslücke

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

CVE-2026-61838 - Lychee: Album password bypass in ZIP downloads

VERWANDTEARTIKEL

CVE-2026-85634 - Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment name

CVE-2026-77466 - Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection

CVE-2026-77470 - Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request

CVE-2026-62679 - Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read

CVE-2026-110812 - Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune

CVE-2026-83905