Description (CNA)
Lychee is a free, open-source photo-management tool. Prior to 7.1.0, an authorization vulnerability exists in Lychee's album password unlock functionality that allows users to gain possibly unauthorized access to other users' password-protected albums. When a user unlocks a password-protected public album, the system automatically unlocks ALL other public albums that share the same password, resulting in a complete authorization bypass. This vulnerability is fixed in 7.1.0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| LycheeOrg / Lychee | affected < 7.1.0 |
CWE
CWE-863
References
- https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-jj56-2c54-4f25
- https://github.com/LycheeOrg/Lychee/commit/f021a29f9ab2bafa81d9f5e32ff5bc89915c7d41
ADP enrichment
No English description supplied.
No references supplied.