CVE-2026-61611

{
  "etk_id": "ETK-2026-1709",
  "cve_id": "CVE-2026-61611",
  "display_id": "CVE-2026-61611",
  "ghsa_id": "GHSA-48vf-fwx6-2ph6",
  "euvd_id": "EUVD-2026-102189",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing password-attempt throttling in Lychee albums",
  "summary": "Lychee versions before 7.6.1 do not limit repeated password attempts when unlocking protected albums. An unauthenticated remote attacker with an album identifier may automate password guessing and access private photos if the album password is recovered.",
  "mitigation": "Upgrade Lychee to version 7.6.1 or later. Restrict public access to protected album endpoints until the update is deployed.",
  "vendor": "LycheeOrg",
  "product": "Lychee",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 7.6.0"
      ],
      "ecosystem": "composer",
      "fixed_versions": [
        "> 7.6.0"
      ],
      "package_name": "lychee-org/lychee",
      "purl": "pkg:composer/lychee-org/lychee"
    }
  ],
  "cwes": [
    307
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": 0.0035,
  "epss_percentile": 0.2737,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 34.70104645,
  "t0_at": "2026-10-15T16:25:24.968000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-15T16:25:24.968000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T16:25:24.968000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-61611"
    }
  }
}