CVE-2026-22784: 
NixOS vulnerability analysis and mitigation

CVE-2026-22784 is an incorrect authorization vulnerability in Lychee, a free open-source photo-management tool, affecting all versions prior to 7.1.0 (≤ 7.0.1). The flaw exists in the album password unlock functionality, where unlocking one password-protected public album automatically unlocks all other public albums across all users that share the same password, resulting in an authorization bypass. It was published on January 12, 2026, and fixed in version 7.1.0. The vulnerability carries a CVSS v3.1 score of 4.3 (Medium) and a CVSS v4.0 score of 2.3 (Low) (GitHub Advisory, Feedly).

The root cause is an oversight in the authorization model classified as CWE-863 (Incorrect Authorization), CWE-284 (Improper Access Control), and CWE-285 (Improper Authorization). The vulnerable code resides in app/Actions/Album/Unlock.php within the propagate(string $password) method, which is invoked after a successful password check via the POST /api/v2/Album::unlock endpoint. When a user correctly unlocks their own album, the propagate() method queries the base_albums and access_permissions database tables for all public albums sharing the same hashed password — regardless of album ownership — and grants session-level access to all of them. The fix introduces a configuration flag enable_propagate_unlock_option (disabled by default) to make propagation opt-in, preventing cross-user album unlocking (GitHub Advisory, Patch Commit).

Successful exploitation results in unauthorized read access to other users' password-protected public albums, exposing photos, metadata, and album contents that the attacker was not intended to view. The impact is limited to confidentiality — there is no integrity or availability impact, as the unlock mechanism only grants session-level view permissions and does not allow modification, deletion, or upload of content. The vulnerability is most impactful in multi-user Lychee installations where different users coincidentally or predictably use the same album password (GitHub Advisory).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.049%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires that a legitimate user account exists on the same Lychee instance as the victim and that both users have set the same password on their respective public albums — a condition that limits practical exploitability (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a multi-user Lychee installation (version ≤ 7.0.1) accessible over the network. Enumerate publicly visible password-protected albums belonging to other users.
2. Create or use an existing account: Register or log in to the Lychee instance as a legitimate user.
3. Create a password-protected album: Create a public album and protect it with a commonly used or guessable password (e.g., password123).
4. Trigger the unlock endpoint: Send a POST /api/v2/Album::unlock request with the album ID and the chosen password to unlock your own album.
5. Observe propagation: Due to the propagate() method in app/Actions/Album/Unlock.php, the system automatically unlocks all other public albums across all users that share the same password in the current session.
6. Access victim albums: Browse to other users' password-protected public albums that share the same password — they are now accessible without re-entering credentials, exposing their photos and metadata (GitHub Advisory).

• Logs: Web server or application logs showing a single POST /api/v2/Album::unlock request followed immediately by access to multiple album endpoints belonging to different user accounts within the same session.
• Application Behavior: A user session gaining access to albums owned by other users without corresponding unlock requests for those specific albums.
• Database: Queries against base_albums and access_permissions tables returning albums from multiple distinct owners in response to a single password hash lookup (GitHub Advisory).

Upgrade Lychee to version 7.1.0 or later, which disables password propagation by default via the new enable_propagate_unlock_option configuration flag (set to 0/disabled). Administrators who require the propagation feature can explicitly enable it in expert settings, with the understanding that it may cause confidentiality issues when users share the same album password. As a workaround prior to patching, administrators should advise users to use unique, non-guessable passwords for their password-protected albums to reduce the likelihood of accidental cross-user unlocking (GitHub Advisory, Patch Commit).

The vulnerability was discovered and reported by security researcher Chakradhar Chirumamilla and was remediated by the LycheeOrg development team. The advisory was published on January 11, 2026, with a low severity rating, and received limited broader industry attention given its narrow scope and low CVSS score. A brief write-up was published at infinitsec.net covering the cross-album password propagation behavior (GitHub Advisory).