The vulnerability exists in Lychee prior to version 7.6.3 and allows an unauthenticated attacker who knows a public, password‑protected album identifier to request a ZIP download via the /api/v2/Zip endpoint. Because the code authorizes the download through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(), the request succeeds even when the album is still locked. The resulting ZIP archive can contain full‑resolution photos and associated metadata if the grants_full_photo_access setting is enabled. The effect is a direct confidentiality breach that exposes user content that should remain private.

Vulnerable installations are those running Lychee photo‑management software version 7.6.2 and earlier. The issue is tied to public, password‑protected albums that have the grants_download option enabled. The patch available in release 7.6.3 removes the missing authorization check.

The CVSS score of 8.2 indicates a high severity, and the EPSS score of less than 1% shows that exploitation is technically difficult but still possible. Because the flaw can be triggered through a simple HTTP GET request to a publicly accessible endpoint and requires only knowledge of the album identifier, an attacker can extract potentially private media data without authentication. The vulnerability is not listed in CISA’s KEV catalog, but the risk to confidentiality and potential reputational damage warrants immediate action.