Lychee Slicer, made by Mango3D, is one of the more popular third-party resin slicers, built to work across many brands of MSLA printers instead of locking users into one manufacturer’s software. The free Lite version does not need an account, but the paid tiers do, and that is where a security researcher who goes by JollyOrc found a way to take over practically any customer account. All an attacker needs is a name, an account email, and maybe a country.
How the flaw works
Mango3D’s own support documentation spells out the process. To change the email tied to an account, a customer contacts support with the old email, the new one, and “a previous Lychee Slicer invoice or a screenshot of your Lychee Slicer account showing the email address you would like us to change.” That screenshot is supposed to prove the request is coming from the real account owner.
JollyOrc’s point is simple: a screenshot of an account dashboard takes seconds to fake in any image editor, and there is no way for a support agent to tell a real one from a doctored one. Anyone who already has a target’s name and account email, information that turns up constantly in unrelated data breaches or on social media, could submit a forged screenshot and get the account’s email swapped over. A normal password reset then hands over the account, along with anything stored in Lychee’s cloud backup.
A month of silence before going public
JollyOrc reported the issue to Mango3D on July 28, 2026, through multiple channels, and suggested a fix: require confirmation from both the old and new email addresses, ideally with a full login during the process. A month later, with no sign the company had started fixing it, JollyOrc published the details on their own blog on August 29. Fabbaloo picked up the report on September 3. As of this writing, Mango3D’s support page on changing an account email still describes the same screenshot-based process, last updated in May.
What to do if you use Lychee Slicer
There is no patch to install here, because Mango3D has not publicly acknowledged the report. JollyOrc’s practical suggestion is to change your account email to one you do not reuse anywhere else. That does not fix Mango3D’s support workflow, but it removes the easy path: someone would need your exact Mango3D login email rather than being able to reuse an address pulled from an unrelated breach. Beyond that, do not assume Lychee’s cloud backup is any safer than the weakest link in this process, and keep local copies of project files you cannot afford to lose.
This is not the first time this year a slicer maker has shipped features faster than the security around them. OrcaSlicer’s new Python plugin system shipped with a sandboxing layer the project’s own documentation calls unfinished. Cloud accounts and plugin ecosystems are becoming standard in slicers, and the security work behind them does not always ship at the same pace.