CVE-2026-39957: 
NixOS vulnerability analysis and mitigation

CVE-2026-39957 is a broken access control vulnerability in Lychee, a free open-source photo-management tool, caused by a SQL operator-precedence bug in SharingController::listAll(). The flaw allows any authenticated non-admin user with upload permission who owns at least one album to retrieve all user-group-based sharing permissions across the entire instance, including metadata for private albums owned by other users. It affects all Lychee versions up to and including v7.5.3, and was disclosed on April 8–9, 2026. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 2.3 (Low) (GitHub Advisory).

The root cause is an incorrect authorization flaw (CWE-863) in app/Http/Controllers/Gallery/SharingController.php at lines 137–138. The orWhereNotNull('user_group_id') call is not wrapped in a closure, causing it to generate a top-level SQL OR condition. Due to SQL operator precedence (AND binds tighter than OR), the resulting query becomes SELECT * FROM access_permissions WHERE (base_album_id IN (SELECT id FROM base_albums WHERE owner_id = :attacker_id) AND user_id IS NOT NULL) OR user_group_id IS NOT NULL, which bypasses the ownership filter entirely for any row with a non-null user_group_id. The fix, merged in PR #4264, wraps both whereNotNull calls inside a single closure: $query->where(fn ($q) => $q->whereNotNull(APC::USER_ID)->orWhereNotNull(APC::USER_GROUP_ID)) (GitHub Advisory, Fix PR).

Successful exploitation allows an authenticated non-admin user to enumerate private album IDs and titles owned by other users, as well as user group IDs and names that have access to those albums. The impact is limited to confidentiality of sharing metadata — no data modification or service disruption is possible. While the vulnerability does not expose photo content directly, leaking album structure and group membership information could facilitate targeted social engineering or further reconnaissance within a multi-user Lychee instance (GitHub Advisory).

1. Obtain credentials: Acquire a valid non-admin Lychee account with upload permission and ownership of at least one album (e.g., via self-registration if enabled, or a compromised account).
2. Authenticate: Log in to the target Lychee instance to obtain a valid session token or cookie.
3. Call the sharing list endpoint: Send an authenticated HTTP GET request to the Lychee API endpoint that invokes SharingController::listAll() (e.g., the sharing management API used by the frontend gallery).
4. Receive unauthorized data: Due to the SQL operator-precedence bug, the response will include all access_permissions rows where user_group_id IS NOT NULL, regardless of album ownership — exposing private album IDs, titles, and associated user group metadata from across the entire instance.
5. Enumerate targets: Use the leaked album IDs and user group information for further reconnaissance or social engineering (GitHub Advisory).

• Logs: Repeated or anomalous authenticated requests to the Lychee sharing list API endpoint (SharingController::listAll) from non-admin user accounts, particularly accounts that own few or no albums but are querying sharing permissions frequently.
• Application Logs: Access log entries showing successful API responses returning large numbers of access_permissions records to low-privilege users.
• Behavioral: Non-admin users accessing sharing metadata for albums they do not own, observable through application-level audit logging if enabled.

Upgrade Lychee to version 7.5.4 or later, which contains the fix introduced in commit 76a3f05 via PR #4264. The fix wraps the whereNotNull/orWhereNotNull calls in a single grouped closure to restore correct SQL boolean evaluation. No configuration-based workaround is available; upgrading is the only remediation. Administrators should also review user accounts with upload permissions to ensure only trusted users have that privilege (Fix Commit, Fix PR).

The vulnerability was discovered and reported by Lychee maintainer ildyria, who also authored the fix. A NixOS/nixpkgs tracking issue (NixOS/nixpkgs#508873) was opened to update the Lychee package in the NixPkgs repository following disclosure. No significant broader media coverage or notable external researcher commentary has been identified beyond the official advisory and automated vulnerability database entries.