{"schema":"threatline.record/2","record":{"id":"CVE-2026-77468","aliases":["GHSA-xg8r-4pm3-2h4f"],"summary":"Lychee: Missing Authentication for Critical Function and Allocation of Resources Without Limits or Throttling on /docs/api","details":"Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by config/scramble.php to unauthenticated callers after installation, with observed response size and latency suggesting that the schema is regenerated without an application-level cache. A remote attacker can repeatedly request the unthrottled route to consume server CPU and obtain a detailed map of the API surface and parameter schema. This issue is fixed in version 7.7.0.","categories":["Unclassified"],"product":"Lychee","vendor":"LycheeOrg","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77468","source_modified_at":"2026-10-15T16:35:21.137Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Lychee","vendor":"LycheeOrg","versions":[{"status":"affected","version":"< 7.7.0"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-xg8r-4pm3-2h4f","source_modified_at":"2026-08-20T20:28:50Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"ecosystem":"composer","name":" lychee-org/lychee"},"range":"<= 7.6.4"}],"fixed_versions":[],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00371,"percentile":0.29825,"score_date":"2026-10-23"},"published_at":"2026-10-15T16:35:21.137Z","modified_at":"2026-10-15T16:35:21.137Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-77468","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-15T16:35:21.137Z"},{"source":"GitHub Advisory Database","url":"https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-xg8r-4pm3-2h4f","fetched_at":"2026-10-23T18:55:00.935475Z","source_modified_at":"2026-08-20T20:28:50Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77468","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-xg8r-4pm3-2h4f","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/LycheeOrg/Lychee/pull/4510","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/LycheeOrg/Lychee/commit/711f4290f53cd980cd5baa2434c734d364e9fe33","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/LycheeOrg/Lychee/releases/tag/v7.7.0","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-15T16:35:21.137Z","content_hash":"460dcbb8ccce8b3cdc57651a622023a30a7f858b951022d2074698b7bc76c113"}}