CVE-2026-77470

Name of the Vulnerable Software and Affected Versions Lychee versions prior to 7.7.1

Description The Supporter or Pro webshop flow at the POST '/api/v2/Shop/Checkout/Process' endpoint accepts an unrestricted additional data array. The CheckoutService::preparePurchaseParameters() function merges this array after server-computed purchase parameters, allowing later string keys to overwrite earlier ones. An unauthenticated buyer can replace the amount, currency, returnUrl, cancelUrl, or transactionId variables before CheckoutService::processPayment() passes them to a non-PayPal Omnipay gateway. This allows an attacker to manipulate the payment amount and obtain auto-fulfilled goods while underpaying the merchant. This issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway.

Recommendations Update to version 7.7.1.