All vulnerabilities
CVE-2026-77468GHSA-xg8r-4pm3-2h4f

Lychee: Missing Authentication for Critical Function and Allocation of Resources Without Limits or Throttling on /docs/api

LycheeOrg Lychee
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.37%Chance of exploitation activity in the next 30 days, higher than 29% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published15 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by config/scramble.php to unauthenticated callers after installation, with observed response size and latency suggesting that the schema is regenerated without an application-level cache. A remote attacker can repeatedly request the unthrottled route to consume server CPU and obtain a detailed map of the API surface and parameter schema. This issue is fixed in version 7.7.0.

Text from CVE List

Affected versions 2

  • Lycheeaffected: < 7.7.0CVE List
  • lychee-org/lychee, composer<= 7.6.4GitHub

References 4