CVE-2026-61610 | LycheeOrg Lychee up to 7.6.0 Photo Highlighting Authorization /api/v2/Photo canHighlight photos_star_visibility improper authorization

October 15, 2026 Yanac

A vulnerability classified as critical has been found in LycheeOrg Lychee up to 7.6.0. Affected is the function PhotoPolicy::canHighlight of the file /api/v2/Photo of the component Photo Highlighting Authorization. This manipulation of the argument photos_star_visibility causes improper authorization.

This vulnerability is tracked as CVE-2026-61610. The attack is possible to be carried out remotely. No exploit exists.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More