Patch Lychee Photo Manager to Stop Unauthorized Payment Manipulation
An unauthenticated flaw in Lychee versions below 7.7.1 lets buyers alter payment amounts, bypassing merchant controls on supported webshops.
Key points
- CVE-2026-77470 allows unauthenticated users to modify purchase parameters via the webshop checkout API.
- The National Vulnerability Database rates the vulnerability as HIGH with a CVSS score of 8.3.
- Lychee version 7.7.1 fixes the issue by restricting how additional data merges with server-computed values.
Unauthenticated attackers can manipulate payment amounts in Lychee Photo Manager installations running versions prior to 7.7.1. This flaw affects environments where the application’s Supporter or Pro webshop feature is enabled and configured with a purchasable item. Security teams managing these deployments must verify their version status immediately, as the vulnerability allows buyers to underpay while receiving fully fulfilled goods. The exposure exists specifically when an affected Omnipay gateway handles the transaction processing.
The risk
The National Vulnerability Database records CVE-2026-77470 as a HIGH severity issue with a CVSS score of 8.3. The vulnerability stems from how the CheckoutService::preparePurchaseParameters() method handles data. It merges an unrestricted additional_data array from the POST /api/v2/Shop/Checkout/Process flow after server-computed parameters are established. Because later string keys overwrite earlier ones, an attacker can replace critical values such as amount, currency, returnUrl, cancelUrl, or transactionId.
Who is exposed
Any Lychee installation using a version lower than 7.7.1 is potentially affected, according to the NVD record. Exposure requires three specific conditions: the webshop feature must be enabled, a purchasable item must exist, and the system must use a non-PayPal Omnipay gateway. If these conditions are met, an unauthenticated buyer can submit a request that tricks the gateway into accepting a lower payment amount while the application processes the order as complete.
Cost and compliance
The source material does not provide specific financial loss figures, regulatory fines, or compliance implications related to this incident. No data regarding affected organizations, incident timelines, or remediation costs is available in the NVD record. Security teams must rely on the technical description of the flaw to assess potential revenue leakage from underpaid transactions.
Our take on the response
Lychee version 7.7.1 addresses the flaw by correcting how the application merges additional data with server-computed purchase parameters. This update ensures that attacker-supplied values cannot overwrite critical transaction details before they reach the payment gateway. Teams should prioritize upgrading to this version to close the vector, as no other fix or workaround is mentioned in the source material.
What defenders should look for
Teams usually monitor payment gateway logs for discrepancies between the amount charged and the order value recorded in the application database. Check whether checkout requests contain unexpected or excessive data in the additional_data fields. Look for successful transaction confirmations where the payment amount is significantly lower than the item price. If anomalies appear, isolate the affected webshops to prevent further underpayment while verifying configuration settings and reviewing access logs for unauthenticated checkout attempts.
What to do and how to stay safe: Lychee
- Verify your Lychee installation version and upgrade to 7.7.1 or later once the vendor provides the update.
- Review payment gateway logs for transactions where the charged amount differs from the expected order total.
- Monitor the /api/v2/Shop/Checkout/Process endpoint for unusual POST requests containing large or unexpected additional_data arrays.
- Temporarily disable the webshop feature if you cannot immediately apply the security update.
Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-77470?
The National Vulnerability Database assigns a CVSS score of 8.3, rating the severity as HIGH.
Which Lychee versions are affected by this vulnerability?
All versions of Lychee prior to 7.7.1 are affected by this payment manipulation flaw.
Is there a fix available for this issue?
Yes, the issue is fixed in Lychee version 7.7.1, according to the NVD record.
