OpenAPI Documentation Exposure in Lychee Photo Management Tool

CVE-2026-77468

What is CVE-2026-77468?

Lychee, a free and open-source photo management tool, exposes its Scramble-generated OpenAPI documentation via the GET /docs/api route to unauthenticated users. This vulnerability allows remote attackers to send repeated requests to an unthrottled endpoint, potentially leading to CPU resource exhaustion and revealing a detailed layout of the API surface and parameter structure. The issue has been addressed in version 7.7.0, which mitigates the risk of unauthorized access and resource depletion.

References