CVE-2026-61838 | LycheeOrg Lychee up to 7.6.2 /api/v2/Zip AlbumPolicy::canDownload improper authorization

October 15, 2026 Yanac

A vulnerability classified as problematic was found in LycheeOrg Lychee up to 7.6.2. Affected by this vulnerability is the function AlbumPolicy::canDownload of the file /api/v2/Zip. Such manipulation leads to improper authorization.

This vulnerability is listed as CVE-2026-61838. The attack may be performed from remote. There is no available exploit.

Upgrading the affected component is advised.VulDB Recent EntriesRead More