Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-77466: Lychee webshop can skip payment using dummy gateway

CVE-2026-77466 · published 20 days ago

Summary

In versions of Lychee before 7.7.0, a test payment method called “Dummy” can be selected during checkout, allowing a buyer to complete an order without actually paying. This can let items be delivered automatically when the store is set to auto‑fulfill. Updating Lychee to version 7.7.0 removes the unintended option and restores proper payment checks.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
lycheeorg	lychee	< 7.7.0

Original advisory text

Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::get_supported_providers(), but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType and does not enforce OmnipayProviderType::isAllowed(). A buyer, including a guest when webshop_allow_guest_checkout is enabled, can submit Dummy directly and complete the test gateway flow without a real payment. When webshop_auto_fulfill_enabled is enabled, OrderCompletedListener::fullfillOrder() can then release the purchasable item. The issue requires access to the Supporter or Pro webshop and an enabled purchasable item. Testing bypassed the closed-source license middleware, so whether the real license layer performs additional payment-provider validation remains unverified. The payment finalize status check itself is not the root cause. This issue is fixed in version 7.7.0.

References

https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-5wh2-hg7q-6hv3 Vendor Advisory
https://github.com/LycheeOrg/Lychee/releases/tag/v7.7.0 URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77466... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-77466 Vendor Advisory
https://github.com/LycheeOrg/Lychee/commit/8b73656f920c682862b9199acc87fbaf72ee5... Patch
https://github.com/LycheeOrg/Lychee/pull/4507 Patch

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

8.6 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-20Improper Input Validation

CWE-184Incomplete List of Disallowed Inputs

Timeline

Published15 Oct 2026

Updated4 Nov 2026

First seen15 Oct 2026

Sources

CVE-2026-77466 · NVD

CVE-2026-77466 · MITRE

CVE-2026-77466 · OSV

GHSA-5wh2-hg7q-6hv3 · GHSA

Track software like this

Free during beta