CVE-2026-77468 Lychee: Missing Authentication for Critical Function and Allocation of Resources Without Limits or Throttling on /docs/api

Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by config/scramble.php to unauthenticated callers after installation, with observed response size and latency suggesting that the schema is regenerate...