CVE-2026-61611

The record

Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize() permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::check without limiting repeated failures. A remote unauthenticated attacker who knows or can obtain an album identifier can automate password guesses against a password-protected album and, if the password is recovered, gain access to its private photo collection. This issue is fixed in version 7.6.1.

Affected packages

Related vulnerabilities

• CVE-2026-116238 In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins… CWE-307
• CVE-2026-111501 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restriction of… CWE-307
• CVE-2026-22114 HTTP basic auth enforces no retry limit or backoff. CWE-307
• CVE-2026-107256 Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield… CWE-307
• CVE-2026-15586 Improper restriction of excessive authentication attempts vulnerability in İdvlabs… CWE-307
• CVE-2026-107145 The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the… CWE-307
• CVE-2026-116007 A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. CWE-307
• CVE-2026-65825 OpenReception's appointment booking software provides an end-to-end encrypted appointment… CWE-307