CVE-2026-77466

Name of the Vulnerable Software and Affected Versions Lychee versions prior to 7.7.0

Description An issue exists where the application fails to enforce provider restrictions during the checkout process. While the OmnipayFactory::get supported providers() function hides the Omnipay Dummy test provider in production, the CreateSessionRequest only validates that the submitted provider is an OmnipayProviderType without checking OmnipayProviderType::isAllowed(). This allows a buyer, including guests if webshop allow guest checkout is enabled, to manually submit the Dummy provider to complete a test gateway flow without making an actual payment. If webshop auto fulfill enabled is active, the OrderCompletedListener::fullfillOrder() function may then release the purchasable item. This requires access to the Supporter or Pro webshop and an enabled purchasable item.

Recommendations Update to version 7.7.0.