Lychee prior to version 7.7.0 has a flaw in its webshop payment processing logic that allows a client to select the Omnipay Dummy gateway, which is normally hidden from production users. The create session request performs only type validation and ignores the isAllowed() check that would block the Dummy provider, enabling an attacker—whether a registered buyer or a guest with webshop_allow_guest_checkout enabled—to complete the checkout flow without a real payment. If webshop_auto_fulfill_enabled is active, the order can be automatically fulfilled, releasing the purchased item to the attacker. This flaw is a classic input validation and logic error (CWE-20 and CWE-184) that results in unauthorized acquisition of paid goods, leading to financial loss for the vendor or end‑users.

The vulnerability affects installations of Lychee on LycheeOrg’s Lychee platform running any pre-7.7.0 release that has the Webshop feature enabled with purchasable items configured. It requires the presence of a Supporter or Pro webshop module, that the Dummy payment provider is available behind the scenes, and that settings such as webshop_allow_guest_checkout or webshop_auto_fulfill_enabled are set to true.

The CVSS base score of 8.3 classifies this issue as high severity, and the EPSS score of less than 1% indicates a very low probability of exploitation at present, though the vulnerability is still actionable. The flaw is not listed in CISA’s KEV catalog, so no known large-scale attacks have been publicly attributed. An attacker can exploit the weakness remotely via HTTP requests to the checkout endpoint, and only needs knowledge that the Dummy provider can be passed through the form—a detail that can be discovered easily through web traffic analysis or developer documentation. Given the potential for non-payment and automated fulfillment, the risk to an organization is significant in terms of financial loss and unauthorized inventory control.