{"id":"CVE-2026-77470","published":"2026-10-15T17:17:27.997","lastModified":"2026-10-15T21:08:49.703","description":"Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwrite earlier keys, an unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before CheckoutService::processPayment() passes the parameters to a non-PayPal Omnipay gateway. An attacker can therefore make a gateway accept a successful payment for an attacker-selected amount and obtain auto-fulfilled goods while underpaying the merchant. The issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway. This issue is fixed in version 7.7.1.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-20","CWE-472","CWE-915"],"vendors":[],"products":[],"references":[{"url":"https://github.com/LycheeOrg/Lychee/commit/24e6e11f1da131ed20b192d7d7b7ca9084451a2f","tags":[]},{"url":"https://github.com/LycheeOrg/Lychee/pull/4514","tags":[]},{"url":"https://github.com/LycheeOrg/Lychee/releases/tag/v7.7.1","tags":[]},{"url":"https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-476v-jr53-8rxc","tags":[]},{"url":"https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-476v-jr53-8rxc","tags":[]}],"exploitRefs":[{"url":"https://github.com/LycheeOrg/Lychee/commit/24e6e11f1da131ed20b192d7d7b7ca9084451a2f","tags":[]},{"url":"https://github.com/LycheeOrg/Lychee/pull/4514","tags":[]},{"url":"https://github.com/LycheeOrg/Lychee/releases/tag/v7.7.1","tags":[]},{"url":"https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-476v-jr53-8rxc","tags":[]},{"url":"https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-476v-jr53-8rxc","tags":[]}],"hasPoc":true,"ai":null}