# CVE-2026-77468: Lychee OpenAPI documentation exposure in /docs/api

Source: https://junglewise.ai/threats/cve-2026-77468-lychee-is-a-free-open-source-photo-management-tool-prior-to-7-7-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-77468 · Severity: info · Published 2026-10-15

Lychee is an open-source photo management application. Before version 7.7.0, the API documentation endpoint at GET /docs/api was accessible to unauthenticated users and was generated on-demand without caching, allowing an attacker to repeatedly request it and consume server CPU resources while mapping the complete API surface and parameters.

Technologies: [LycheeOrg Lychee](https://junglewise.ai/threats/technologies/lychee). Vendors: [LycheeOrg](https://junglewise.ai/threats/vendors/lycheeorg).

## Quick answers

**Is CVE-2026-77468 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77468 being exploited in the wild.

**How severe is CVE-2026-77468?** Informational severity, published 15 October 2026.

**Which products and versions are affected?** LycheeOrg Lychee before 7.7.0.

**Is there a fix for CVE-2026-77468?** Yes: fixed in 7.7.0. Until then: Restrict network access to the GET /docs/api endpoint using a reverse proxy or firewall until upgrading to version 7.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77468 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-77468?** Check whether you run LycheeOrg Lychee at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.7.0

Restrict network access to the GET /docs/api endpoint using a reverse proxy or firewall until upgrading to version 7.7.0.

## Technical details

The vulnerability exposes an unauthenticated, unthrottled route that dynamically generates Scramble-based OpenAPI schema documentation, serving it without application-level caching. Remote attackers can exhaust server CPU by repeated requests and obtain a complete enumeration of API endpoints and parameter schemas. The fix in 7.7.0 adds middleware to restrict access and implements caching to prevent regeneration on each request.

## Affected products

- LycheeOrg Lychee before 7.7.0

## Timeline

- 2026-10-15: disclosed
- 2026-07-13: patched

## References

- [https://github.com/LycheeOrg/Lychee/commit/711f4290f53cd980cd5baa2434c734d364e9fe33](https://github.com/LycheeOrg/Lychee/commit/711f4290f53cd980cd5baa2434c734d364e9fe33)
- [https://github.com/LycheeOrg/Lychee/pull/4510](https://github.com/LycheeOrg/Lychee/pull/4510)

## Related threats

- [Lychee PDF denial of service via oversized MediaBox](https://junglewise.ai/threats/cve-2026-77467-lychee-is-a-free-open-source-photo-management-tool-prior-to-7-7-0)
- [Lychee path traversal in SecurePathController image serving](https://junglewise.ai/threats/cve-2026-62679-lychee-is-a-free-open-source-photo-management-tool-prior-to-7-6-4)
- [Lychee album unlock brute-force attack](https://junglewise.ai/threats/cve-2026-61611-lychee-is-a-free-open-source-photo-management-tool-prior-to-7-6-1)
- [Lychee authorization bypass in photo highlighting](https://junglewise.ai/threats/cve-2026-61610-lychee-is-a-free-open-source-photo-management-tool-prior-to-7-6-1)
- [Lychee stored cross-site scripting in album and photo descriptions](https://junglewise.ai/threats/cve-2026-57568-lychee-is-a-free-open-source-photo-management-tool-prior-to-7-6-0)