CVE-2026-774668.3HighCWE-184

CVE-2026-77466: Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection

LycheeOrg · Lychee

Affected: LycheeOrg · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.4%probability of exploitation in the next 30 days

38th percentile

050100

Higher than 38% of scored CVEs

8.3HighCVSS 4.0

LowMediumHighCrit.

DescriptionCVE.org

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in production through OmnipayFactory::get_supported_providers(), but CreateSessionRequest validates only that the submitted provider is an OmnipayProviderType and does not enforce OmnipayProviderType::isAllowed(). A buyer, including a guest when webshop_allow_guest_checkout is enabled, can submit Dummy directly and complete the test gateway flow without a real payment. When webshop_auto_fulfill_enabled is enabled, OrderCompletedListener::fullfillOrder() can then release the purchasable item. The issue requires access to the Supporter or Pro webshop and an enabled purchasable item. Testing bypassed the closed-source license middleware, so whether the real license layer performs additional payment-provider validation remains unverified. The payment finalize status check itself is not the root cause. This issue is fixed in version 7.7.0.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

LycheeOrg · Lychee< 7.7.0

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Incomplete List of Disallowed Inputs · Input Validation and Logic
Vendor: LycheeOrg
Published: October 2026
Band: Unlikely (under 1%), October 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-77466 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.