An authorization flaw in Lychee’s album password unlock feature allows a user to gain unauthorized access to other users’ password‑protected albums. When a public album is unlocked, the system automatically lifts the password restriction for all other public albums that share the same password, effectively bypassing the intended access controls. This flaw can lead to disclosure of private photos and content that the user was not permitted to view.

The vulnerability affects environments running Lychee before version 7.1.0. It involves the LycheeOrg Lychee product, broadly described as a free, open‑source photo‑management tool. No specific sub‑components or licensing variants are identified beyond those included in the primary application.

The CVSS score of 2.3 indicates low severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, which further mitigates immediate risk. Based on the description, the likely attack vector involves an authenticated user who knows the password of a public album; the system then propagates that password to all other public albums with the same credential, thereby bypassing authorization checks. No additional attacker prerequisites are specified beyond knowledge of the shared password.