CVE-2026-61611
Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks
CVSS score
7.5
EPSS probability
—
Risk score
0.8
Published
19 h ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
8.9
CVE-2026-62679
Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read
L
Patch status unknown
8.3
CVE-2026-77466
Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection
L
Patch status unknown
8.3
CVE-2026-77470
Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request
L
Patch status unknown
8.2
CVE-2026-61838
Lychee: Album password bypass in ZIP downloads
L
Patch status unknown
7.1
CVE-2026-77467
Lychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing path
L
Patch status unknown
6.9
CVE-2026-77468
Lychee: Missing Authentication for Critical Function and Allocation of Resources Without Limits or Throttling on /docs/api
L
Patch status unknown
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-61611"