Lychee validation flaw CVE-2026-77466 enables free checkout; fix in v7.7.0

Lychee, an open-source photo-management platform, contains a high-severity input validation flaw that permits unauthorized access to paid digital items. The vulnerability, tracked as CVE-2026-77466, exists in the web shop component and allows attackers to complete transactions using a test payment gateway. This issue affects deployments running versions older than 7.7.0. The flaw enables users to bypass legitimate payment requirements under specific configuration settings.

Root cause

The underlying technical issue stems from inconsistent validation between the user interface and the backend request handler. According to the NVD record, the application hides the Omnipay Dummy test provider from checkout options in production environments. This hiding mechanism relies on the OmnipayFactory::get_supported_providers() function. However, the CreateSessionRequest handler only verifies that the submitted provider matches the OmnipayProviderType class. It fails to enforce the OmnipayProviderType::isAllowed() check, which is responsible for blocking test providers in live systems.

Attack path

An attacker can exploit this gap by manually submitting the Dummy provider during the checkout process. This action succeeds even though the provider is not displayed in the standard user interface. The NVD description notes that a buyer, including a guest user if webshop_allow_guest_checkout is enabled, can initiate this flow. If the webshop_auto_fulfill_enabled setting is active, the OrderCompletedListener::fullfillOrder() function executes upon completion. This listener then releases the purchasable item to the user without requiring a real financial transaction.

Affected versions

• Lychee versions prior to 7.7.0 are vulnerable to CVE-2026-77466.
• The issue requires the web shop feature to be active with purchasable items configured.
• Access to the Supporter or Pro webshop tier is necessary for the exploit to function.
• The fix is available in version 7.7.0, which corrects the validation logic.

Mitigation

• Upgrade the Lychee installation to version 7.7.0 or later to apply the vendor's patch.
• Disable the webshop_auto_fulfill_enabled setting to prevent automatic item release.
• Turn off webshop_allow_guest_checkout to restrict access to authenticated users only.
• Verify that the closed-source license middleware performs additional payment-provider validation.

Signals worth monitoring

Security teams should monitor web server logs for checkout requests that specify test or dummy payment providers. Look for successful transaction completions where the payment method does not match standard live gateways. Alert on order fulfillment events that occur without corresponding payment gateway confirmations. Check for unusual spikes in digital item downloads or access grants. Investigate any sessions where the selected provider differs from the list presented to the user. Review configuration changes related to guest checkout and auto-fulfillment settings.

What to do and how to stay safe: Lychee

• Check your current Lychee version and upgrade to 7.7.0 if you are running an older release.
• Audit your web shop configuration to ensure guest checkout and auto-fulfillment are disabled if not needed.
• Review access logs for any instances where test payment providers were used in production.
• Monitor for unauthorized access to paid content and revoke access for affected users immediately.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-77466?

The Common Vulnerability Scoring System rate is 8.3, which is classified as high severity.

Does this bug affect all Lychee installations?

No, it only affects installations that have the web shop feature enabled with purchasable items.

Is there a confirmed fix for this vulnerability?

Yes, the vendor has released version 7.7.0, which addresses the input validation flaw.