CVE-2026-77468: Lychee Photo Management Tool DOS Vulnerability

CVE-2026-77468 Overview

Lychee, a free open-source photo-management tool, exposes its Scramble-generated OpenAPI documentation to unauthenticated callers via the GET /docs/api route. Prior to version 7.7.0, the route lacks both access controls and application-level caching. Each request triggers full regeneration of the OpenAPI schema, as evidenced by response size and latency observations. Remote attackers can repeatedly invoke this unthrottled endpoint to exhaust server CPU resources. Attackers also obtain a detailed map of the API surface and parameter schemas, aiding reconnaissance for follow-on attacks. The issue is tracked as [CWE-770] (Allocation of Resources Without Limits or Throttling) and is fixed in Lychee version 7.7.0.

Critical Impact
Unauthenticated remote attackers can trigger repeated OpenAPI schema regeneration to exhaust CPU and enumerate the full API surface for reconnaissance.

Affected Products

Lychee photo-management tool prior to version 7.7.0
Installations exposing the /docs/api route to untrusted networks
Deployments using default config/scramble.php configuration without upstream throttling

Discovery Timeline

2026-10-15 - CVE CVE-2026-77468 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-77468

Vulnerability Analysis

The vulnerability resides in Lychee's integration with the Dedoc Scramble package, which generates OpenAPI documentation from controller annotations and route definitions. The GET /docs/api route is registered without authentication middleware and without rate limiting. Each incoming request triggers Scramble's Generator to walk routes, resolve type information, and serialize a complete OpenAPI document.

Response-size and latency measurements indicate that schema generation runs synchronously on every request with no application-level cache. An attacker who issues parallel requests forces repeated CPU-intensive serialization, degrading availability for legitimate users. The returned document also reveals endpoint paths, HTTP methods, parameter names, types, and validation constraints that would otherwise require manual enumeration.

Root Cause

Two defects combine to produce the issue. First, the /docs/api route is publicly reachable after installation with no access restriction. Second, config/scramble.php does not define a cache store for the generated OpenAPI document, so Scramble regenerates it on every request. Together these create an unbounded resource consumption condition classified as [CWE-770].

Attack Vector

Exploitation requires only network reachability to the Lychee instance. An attacker sends repeated unauthenticated GET /docs/api requests, optionally in parallel, to amplify CPU load. The same requests return a complete API map suitable for building targeted follow-on exploits against authenticated endpoints.

php

// Security patch excerpt — config/scramble.php
// Adds a cache store so the OpenAPI document is not regenerated per request
'export_path' => 'api.json',

/*
 * Cache configuration for the generated OpenAPI document.
 *
 * Use `php artisan scramble:cache` to warm the cache and
 * `php artisan scramble:clear` to invalidate it.
 */
'cache' => [
    'key'   => 'scramble.openapi',
    'store' => config('cache.default'),
],

'info' => [
    /*
     * API version.
     */
];
// Source: https://github.com/LycheeOrg/Lychee/commit/711f4290f53cd980cd5baa2434c734d364e9fe33

The fix also introduces app/Http/Middleware/RestrictApiDocsAccess.php, which hides the docs route entirely (returning 404) on white-label installs rather than merely returning an unauthorized response.

Detection Methods for CVE-2026-77468

Indicators of Compromise

Repeated unauthenticated GET /docs/api requests from the same source IP or a small set of IPs
Sustained high CPU utilization on the Lychee PHP worker process correlated with /docs/api traffic
Access log entries showing large response payloads returned by /docs/api to anonymous callers

Detection Strategies

Alert on anomalous request rates to /docs/api or /api.json from a single client
Correlate web server access logs with PHP-FPM or worker CPU metrics to identify generation-driven spikes
Baseline normal documentation traffic and flag deviations consistent with scripted enumeration

Monitoring Recommendations

Enable web server access logging with client IP, user agent, and response size for all /docs/* paths
Export Lychee application and reverse-proxy metrics to a centralized log and metrics platform for correlation
Monitor outbound reconnaissance patterns where enumerated endpoints appear in subsequent authenticated attack attempts

How to Mitigate CVE-2026-77468

Immediate Actions Required

Upgrade Lychee to version 7.7.0 or later, which introduces the RestrictApiDocsAccess middleware and OpenAPI cache
Restrict access to /docs/api at the reverse proxy or WAF layer until the upgrade is applied
Apply request-rate limits to /docs/api to blunt resource-exhaustion attempts

Patch Information

The fix is included in Lychee release v7.7.0 and merged via Pull Request #4510. The underlying code changes are available in commit 711f4290. Full remediation guidance is published in GitHub Security Advisory GHSA-xg8r-4pm3-2h4f.

Workarounds

Block /docs/api at the reverse proxy (for example, nginx location deny rule) for untrusted networks
Enforce authentication in front of the docs route using an edge auth proxy
Apply a rate limit (for example, 1 request per minute per IP) to /docs/api until the upgrade is deployed

bash

# nginx reverse-proxy configuration example
location = /docs/api {
    allow 10.0.0.0/8;    # internal admin network
    deny all;
    limit_req zone=docs_api burst=2 nodelay;
    proxy_pass http://lychee_upstream;
}

# limit_req_zone defined at http{} scope:
# limit_req_zone $binary_remote_addr zone=docs_api:10m rate=1r/m;