{"id":"CVE-2026-61611","revision":"88813fd58e784cc4b15251e9cc747058","records":[{"revision":"88813fd58e784cc4b15251e9cc747058","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-61611","aliases":[],"title":"Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks","description":"Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize() permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::check without limiting repeated failures. A remote unauthenticated attacker who knows or can obtain an album identifier can automate password guesses against a password-protected album and, if the password is recovered, gain access to its private photo collection. This issue is fixed in version 7.6.1.","state":0,"publishedAt":"2026-10-15T16:25:24.968+00:00","modifiedAt":"2026-10-15T16:25:24.968+00:00","affected":[{"ecosystem":"Vendor product","name":"Lychee","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"LycheeOrg\",\n                    \"product\": \"Lychee\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 7.6.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-48vf-fwx6-2ph6","https://github.com/LycheeOrg/Lychee/pull/4448","https://github.com/LycheeOrg/Lychee/commit/592291458a3373114a21412956fd23cfcda32aba","https://github.com/LycheeOrg/Lychee/releases/tag/v7.6.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-61611","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-61611","identifiers":["CVE-2026-61611"]},"retained":false,"historicalAffected":[]}],"coverage":[]}