CVE-2026-77468
Deferred Deferred - Pending Action

Lychee API Documentation Exposure via Unauthenticated Access

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by config/scramble.php to unauthenticated callers after installation, with observed response size and latency suggesting that the schema is regenerated without an application-level cache. A remote attacker can repeatedly request the unthrottled route to consume server CPU and obtain a detailed map of the API surface and parameter schema. This issue is fixed in version 7.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-77468
EUVD
EUVD-2026-102195

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
LycheeOrg Lychee < 7.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77468 is a vulnerability in Lychee versions 7.6.4 and earlier where the /docs/api endpoint exposes OpenAPI documentation without authentication, throttling, or proper caching. The endpoint regenerates the schema on every request, consuming significant CPU resources and taking about 4 seconds per request. This allows unauthenticated attackers to gather API details and amplify resource consumption through repeated requests.

Detection Guidance

Check if the /docs/api endpoint is accessible without authentication by using curl commands like 'curl -I http://your-server/docs/api' or 'curl http://your-server/docs/api'. Monitor server CPU usage during repeated requests to this endpoint. Verify if OpenAPI documentation is regenerated per request by checking response times around 4 seconds.

Impact Analysis

This vulnerability can lead to server CPU exhaustion due to repeated unauthenticated requests to the /docs/api endpoint, causing low availability or performance degradation. Attackers can also map the API surface and parameter schema, enabling further exploitation or reconnaissance of the application.

Compliance Impact

This vulnerability does not directly impact GDPR or HIPAA compliance as it primarily involves unauthorized access to API documentation and server resource exhaustion. However, if the API exposes personal data in its schema, it could indirectly affect compliance by increasing the risk of data exposure or unauthorized access to sensitive information.

Mitigation Strategies

Upgrade Lychee to version 7.7.0 or later. Enable the RestrictedDocsAccess middleware and configure rate limiting. Ensure OpenAPI documentation caching is active in config/scramble.php. Disable the API documentation link in white-label mode via admin dashboard settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77468. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart