CVE-2026-61611

HighCVSS 7.5/10Last modified Oct 15, 2026

Description

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize() permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::check without limiting repeated failures. A remote unauthenticated attacker who knows or can obtain an album identifier can automate password guesses against a password-protected album and, if the password is recovered, gain access to its private photo collection. This issue is fixed in version 7.6.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-307

Affected software

No affected versions have been published.

Timeline

Published: Oct 15, 2026
Last modified: Oct 15, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-616125.7CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard `validateServerUrl` (added for CVE-2 CVE-2026-616137.7Cursor is a code editor built for programming with AI. Prior to the Cloud Agent fix on 03/31/2026, browser-enabled Cursor Cloud Agent sessio CVE-2026-616145.9SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a `?token=` CVE-2026-616177.7Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write p CVE-2026-61623.5A vulnerability has been found in PHPGurukul Company Visitor Management System 2.0. This impacts an unknown function of the file /bwdates-re CVE-2026-616256.8VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore doe CVE-2026-616288.1nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as a CVE-2026-616297.5nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's CVE-2026-61637.3A vulnerability was identified in code-projects Lost and Found Thing Management 1.0. Affected by this issue is some unknown functionality of CVE-2026-616304.2nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can ha CVE-2026-616325.3PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.21.3, the b64 extensi CVE-2026-616332.0NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nni_mqtt_msg_decode_unsubscribe() in nng/src/supplemental/mqtt/mqtt_c