LycheeOrg Lychee, an open-source photo management tool, suffers from an authorization bypass vulnerability in versions before 7.5.4. The root cause is a SQL operator-precedence bug in the SharingController::listAll() method, where the orWhereNotNull('user_group_id') clause bypasses the ownership filter applied by the when() block. This allows authenticated non-admin users with upload permissions and at least one owned album to retrieve sharing permissions for all user groups, including those related to private albums owned by other users. The vulnerability is classified under CWE-863 and has a CVSS 4.0 score of 2.3, indicating low severity. The issue is resolved in Lychee version 7.5.4.

An attacker who is an authenticated non-admin user with upload permissions and owns at least one album can access sharing permissions for all user groups across the Lychee instance. This includes private albums owned by other users, potentially exposing sensitive sharing configurations. The impact is limited to information disclosure of sharing permissions and does not include privilege escalation or direct access to album contents. The vulnerability has a low severity rating.

This vulnerability is fixed in Lychee version 7.5.4. Users should upgrade to version 7.5.4 or later to remediate this issue. No official patch or temporary fix is indicated beyond upgrading. Since this is not a cloud service, remediation depends on applying the update. Patch status is confirmed by the vendor advisory stating the fix is included in version 7.5.4.