Lychee, an open‑source photo‑management platform, permitted an unauthenticated attacker to query the highlight API when the photos_star_visibility setting is configured as anonymous. By guessing a photo identifier and sending a POST request to /api/v2/Photo::highlight, the attacker could detect whether a private or password‑protected photo existed because the API returns differing responses for present versus absent photos. Additionally, the attacker could toggle the is_highlighted flag of any photo, including those in private or password‑protected albums, thereby leaking existence data and modifying state.

All Lychee installations prior to version 7.6.1 that use the anonymous photos_star_visibility value are affected. The flaw does not exist in the default configuration nor in releases 7.6.1 and later. Any deployment that has chosen this non‑default setting before the fix is vulnerable.

The CVSS score of 2.3 marks the issue as low severity overall. An EPSS value below 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker needs only unauthenticated HTTP requests to the highlight endpoint after guessing a photo identifier; no credentials or further privileges are required. While the limited impact and rarity of exploitation reduce urgency, patching and monitoring remain advisable.