{"schema":"threatline.record/2","record":{"id":"CVE-2026-77470","aliases":["GHSA-476v-jr53-8rxc"],"summary":"Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request","details":"Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwrite earlier keys, an unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before CheckoutService::processPayment() passes the parameters to a non-PayPal Omnipay gateway. An attacker can therefore make a gateway accept a successful payment for an attacker-selected amount and obtain auto-fulfilled goods while underpaying the merchant. The issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway. This issue is fixed in version 7.7.1.","categories":["Unclassified"],"product":"Lychee","vendor":"LycheeOrg","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77470","source_modified_at":"2026-10-15T18:30:17.464Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Lychee","vendor":"LycheeOrg","versions":[{"status":"affected","version":"< 7.7.1"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-476v-jr53-8rxc","source_modified_at":"2026-08-20T20:29:59Z","fetched_at":"2026-10-23T22:01:05.715934Z","package":{"ecosystem":"composer","name":"lychee-org/lychee"},"range":"<= 7.7.0"}],"fixed_versions":[],"cvss":8.3,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00451,"percentile":0.38254,"score_date":"2026-10-23"},"published_at":"2026-10-15T16:36:09.597Z","modified_at":"2026-10-15T18:30:17.464Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-77470","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-15T18:30:17.464Z"},{"source":"GitHub Advisory Database","url":"https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-476v-jr53-8rxc","fetched_at":"2026-10-23T22:01:05.715934Z","source_modified_at":"2026-08-20T20:29:59Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77470","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-476v-jr53-8rxc","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/LycheeOrg/Lychee/pull/4514","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/LycheeOrg/Lychee/commit/24e6e11f1da131ed20b192d7d7b7ca9084451a2f","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/LycheeOrg/Lychee/releases/tag/v7.7.1","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-15T18:29:45.817503Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-15T18:30:17.464Z","content_hash":"c74f119dd5003c69371b0c5354d96edbdcffb333a6585146066d433e8275b617"}}