CVE-2026-77468: Lychee: Missing Authentication for Critical Function and Allocation of Resources Without Limits or Throttling on /docs/api
Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by config/scramble.php to unauthenticated callers after installation, with observed response size and latency suggesting that the schema is regenerated without an application-level cache. A remote attacker can repeatedly request the unthrottled route to consume server CPU and obtain a detailed map of the API surface and parameter schema. This issue is fixed in version 7.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lycheeto a version that resolves this vulnerability.Fixed in 7.7.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Lychee installations running versions before 7.7.0 are affected if the /docs/api route is reachable by remote unauthenticated callers after installation.
What does an attacker need to exploit this issue?
An attacker only needs network access to repeatedly send GET requests to /docs/api. No authentication is required for the documented route.
What are the practical impacts of exploitation?
Repeated requests can consume server CPU because the OpenAPI schema appears to be regenerated without an application-level cache. The endpoint also exposes detailed API-surface and parameter-schema information to unauthenticated callers.
What should be done if an immediate upgrade is not possible?
Restrict unauthenticated remote access to /docs/api and apply request throttling or rate limits at a reverse proxy or other network control. Upgrading to Lychee 7.7.0 fixes the issue.