CVE-2026-39957

OVERVIEW: CVE-2026-39957 is a SQL operator-precedence bug in Lychee, an open-source photo-management application, affecting versions prior to 7.5.4. The vulnerability exists in the SharingController::listAll() function, where a malformed orWhereNotNull clause bypasses ownership filters, allowing authenticated users with upload permissions to enumerate user-group-based sharing permissions across the entire instance. SEVERITY: The vulnerability carries a CVSS 3.1 score of 4.3 (Medium severity) with a network-based attack vector requiring low complexity and user authentication. The impact is limited to confidentiality, exposing sensitive information about album sharing configurations and potentially revealing private albums belonging to other users, while maintaining integrity and availability. The FAUCET Risk Score of 38.0 indicates moderate concern within the broader threat landscape. EXPLOITATION STATUS: There is no evidence of active exploitation in the wild, as indicated by the absence of KEV designation and inactive status on public exploit lists. The EPSS score of 0.00033 suggests minimal probability of exploitation attempts. While the vulnerability requires authentication and specific permissions to exploit, organizations running Lychee versions prior to 7.5.4 should apply patches promptly to prevent potential information disclosure.