CVE-2026-77466: CWE-20: Improper Input Validation in LycheeOrg Lychee

Lychee, an open-source photo-management tool, prior to version 7.7.0, improperly validates the payment provider input in CreateSessionRequest. Although the Omnipay Dummy test provider is hidden in production via OmnipayFactory::get_supported_providers(), the validation only checks if the submitted provider is an OmnipayProviderType and does not enforce if it is allowed via OmnipayProviderType::isAllowed(). This allows a buyer, including guests if webshop_allow_guest_checkout is enabled, to submit the Dummy provider directly and complete the test gateway flow without actual payment. If webshop_auto_fulfill_enabled is enabled, the OrderCompletedListener::fullfillOrder() function can release the purchasable item without payment. The vulnerability requires access to the Supporter or Pro webshop and enabled purchasable items. The issue was fixed in version 7.7.0.

An attacker with access to the Supporter or Pro webshop and enabled purchasable items can bypass payment by submitting the Dummy payment provider directly, completing the test payment flow without real payment. This can lead to unauthorized fulfillment and release of purchasable items. The vulnerability affects payment integrity and could result in financial loss or unauthorized access to paid content. The vulnerability requires specific configuration settings (guest checkout and auto-fulfillment enabled) and access to certain webshop tiers.

Upgrade Lychee to version 7.7.0 or later, where this vulnerability is fixed. The fix enforces proper validation of allowed payment providers, preventing the use of the Dummy test provider in production. Until upgrading, ensure webshop_allow_guest_checkout and webshop_auto_fulfill_enabled settings are carefully controlled or disabled to reduce risk. Verify any license middleware or additional payment validation layers are properly configured. Patch status is confirmed fixed in version 7.7.0.