{"metadata": {"vulnerability": "CVE-2026-61611", "count": 8, "kinds": {"milestone": 3, "sighting": 2, "kev": 0, "other": 3}}, "data": [{"timestamp": "2026-07-10T17:36:04.598Z", "date_only": false, "value": "2026-07-10T17:36:04.598Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-61611", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-15T16:25:24.968Z", "date_only": false, "value": "2026-10-15T16:25:24.968Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61611", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-15T16:25:24.968Z", "date_only": false, "value": "2026-10-15T16:25:24.968Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-61611", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T16:25:24.968Z", "date_only": false, "value": "2026-10-15T16:25:24.968Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-61611", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T16:40:48.328Z", "date_only": false, "value": "2026-10-15T16:40:48.328688Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117445915279672870", "record": "CVE-2026-61611", "field": "creation_timestamp", "uuid": "dc2d45d5-9d71-4233-b092-745459427ccf", "content": "CVE-2026-61611 Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA, or lockout. UnlockAlbumRequest::authorize() permits any caller to submit attempts, and app/Actions/Album/Unlock.php verifies each guess with Hash::check without limiting repeated failures. A remote unauthenticated attacker who knows or can obtain an album identifier can automate password guesses against a password-protected album and, if the password is recovered, gain access to its private photo collection. This issue is fixed in version 7.6.1.\nhttps://www.cve.org/CVERecord?id=CVE-2026-61611https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-48vf-fwx6-2ph6https://github.com/LycheeOrg/Lychee/pull/4448https://github.com/LycheeOrg/Lychee/commit/592291458a3373114a21412956fd23cfcda32abahttps://github.com/LycheeOrg/Lychee/releases/tag/v7.6.1#LycheeOrg #Lychee#CVE_2026_61611#bot", "url": "https://infosec.exchange/users/cve/statuses/117445915279672870"}, {"timestamp": "2026-10-15T17:17:26.537Z", "date_only": false, "value": "2026-10-15T17:17:26.537", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61611", "record": "FKIE_CVE-2026-61611", "field": "published"}, {"timestamp": "2026-10-15T18:48:28.357Z", "date_only": false, "value": "2026-10-15T18:48:28.357659Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxwpz5vu4j2n", "record": "CVE-2026-61611", "field": "creation_timestamp", "uuid": "6795b65c-2c13-492b-a32b-2054245e4ee7", "content": "\ud83d\udfe0 CVE-2026-61611 - High (7.5)\n\nLychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock h...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-61611/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxwpz5vu4j2n"}, {"timestamp": "2026-10-15T21:08:49.703Z", "date_only": false, "value": "2026-10-15T21:08:49.703", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61611", "record": "FKIE_CVE-2026-61611", "field": "lastModified"}]}