Lychee, a free open‑source photo‑management tool, contains an endpoint POST /api/v2/Album::unlock that lacks throttling or lockout. This allows an attacker who knows or can obtain an album identifier to submit password guesses repeatedly. If the password is recovered, the attacker gains direct access to the private photo collection. The vulnerability is a form of brute‑force attack that bypasses authentication and exposes confidential media.

Vulnerable only in Lychee prior to version 7.6.1. The fix was introduced in the 7.6.1 release, so any installation using 7.6.0 or older without applying that patch is at risk.

The CVSS score of 7.5 denotes medium‑to‑high risk. EPSS indicates an exploitation probability of less than 1%, suggesting low likelihood but still possible, especially for determined attackers. The vulnerability is not listed in CISA KEV, but the lack of rate limiting means the attack surface is large. The attack vector is remote, via the public API; no authentication or privileged access is required, so an unauthenticated attacker can perform the brute‑force attempts.