{"id":"CVE-2026-77468","title":"Lychee is a free, open-source photo-management tool","summary":"Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by config/scramble.php to unauthenticated callers after installation, with observed respon…","severity":"medium","cvss":6.9,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","cwe":["CWE-770"],"vendor":"LycheeOrg","product":"Lychee","affected":["Lychee < 7.7.0"],"published":"2026-10-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T17:17:27.860","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77468","references":[{"url":"https://github.com/LycheeOrg/Lychee/commit/711f4290f53cd980cd5baa2434c734d364e9fe33","label":"security-advisories@github.com"},{"url":"https://github.com/LycheeOrg/Lychee/pull/4510","label":"security-advisories@github.com"},{"url":"https://github.com/LycheeOrg/Lychee/releases/tag/v7.7.0","label":"security-advisories@github.com"},{"url":"https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-xg8r-4pm3-2h4f","label":"security-advisories@github.com"}],"tags":["nvd","cve.org"],"cvssSource":"cna","ingestedAt":"2026-10-15T17:18:20.101Z","slug":"CVE-2026-77468","body":"## Overview\n\nLychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by config/scramble.php to unauthenticated callers after installation, with observed response size and latency suggesting that the schema is regenerated without an application-level cache. A remote attacker can repeatedly request the unthrottled route to consume server CPU and obtain a detailed map of the API surface and parameter schema. This issue is fixed in version 7.7.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":38,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}