CVE-2026-77468 Details

A vulnerability in Lychee, a photo management tool, allows unauthenticated access to the Scramble-generated OpenAPI documentation via the '/docs/api' endpoint, prior to version 7.7.0. The absence of authentication and response caching, combined with the route's unthrottled nature, enables remote attackers to repeatedly access the documentation. This not only consumes server CPU resources but also provides a detailed overview of the API surface and parameter schema, facilitating reconnaissance for potential attacks.

Users are advised to update to Lychee version 7.7.0 or later, and to enable the 'RestrictedDocsAccess' middleware in production environments. Instructions for updating can be found in the Lychee GitHub repository.