Lychee’s checkout endpoint accepts an additional_data array in a POST request that is merged after the server calculates purchase parameters. Because later keys overwrite earlier ones, an unauthenticated attacker can overwrite server‑computed values such as amount, currency, returnUrl, cancelUrl, or transactionId. This allows the attacker to set a lower payment amount or otherwise tamper with the transaction before it is sent to the Omnipay gateway, resulting in the vendor receiving a payment for an amount that was not agreed upon and delivering goods or services for underpayment.

The vulnerability affects the Lychee photo‑management application from LycheeOrg. Versions released before 7.7.1 are impacted when the webshop feature is enabled and a purchasable item is available through an Omnipay gateway. The issue is fixed in Lychee v7.7.1 and later releases.

The CVSS score is 8.3, indicating a high severity of an unauthorized data modification flaw. The EPSS probability is below 1 %, and the vulnerability is not listed in CISA KEV. The attack is remote and requires only HTTP access to the Lychee instance, no authentication, and a crafted POST payload. When the webshop is enabled with a supported Omnipay gateway, financial damage can occur with minimal effort, though the low exploitation probability means the risk is moderate.