Lychee CVE-2026-77468

Requires a Lychee instance prior to version 7.7.0 that has completed installation, where the GET /docs/api route serving Scramble-generated OpenAPI documentation is exposed by default (the restricting middleware was commented out before the fix) and is both unauthenticated and unthrottled. No special configuration, credentials, or user interaction are needed - remote unauthenticated exploitation works against default post-installation deployments. Limiting factors: the instance must be network-reachable by the attacker; the impact is bounded to CPU/availability degradation plus API-schema disclosure rather than code execution or data compromise; white-label installs behave differently post-patch (route hidden); and upgrading to 7.7.0, which adds caching and the RestrictApiDocsAccess middleware, fully removes the condition.

This is a medium-severity resource-exhaustion issue (CWE-770), not a high-priority emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity reachability with no user interaction, but the impact is deliberately scoped to availability-only (VA:L) with no confidentiality or integrity impact in the vendor's reading - the 6.9 score reflects easy reach paired with limited, partial impact rather than a critical flaw. No EPSS score, KEV listing, POC, or SSVC decision data was supplied; per the precision rules this means no public exploit has been identified at time of analysis and there is no evidence of active exploitation, so the only confirmed signals are the CVSS metrics and the GitHub security advisory/patch. Note a minor tension between the vendor vector and the description: the vendor sets VC:N, yet the description explicitly states the attacker can 'obtain a detailed map of the API surface and parameter schema,' which is a genuine low-level information-disclosure impact the vendor vector omits - this analysis treats that as a secondary C:L effect. The headline DoS impact is also qualified: the advisory describes CPU consumption from uncached schema regeneration (observed via response size/latency) rather than a confirmed full-service outage, so real-world risk is best characterized as service degradation under sustained request volume, not guaranteed takedown.

An attacker locates an internet-exposed Lychee instance (version prior to 7.7.0) that has completed installation and sends a high-rate stream of GET /docs/api requests. Because the route is unauthenticated, unthrottled, and the Scramble-generated OpenAPI document is regenerated without an application-level cache, each request forces fresh schema generation and consumes server CPU, degrading availability for legitimate users; the same responses also hand the attacker a complete map of the API surface and parameter schema. No public proof-of-concept exploit was identified in the provided data.