The vulnerability allows unauthenticated users to request the /docs/api route, which regenerates the OpenAPI schema on every request without any caching. This leads to unnecessary CPU consumption and provides the attacker with a comprehensive map of the API surface, potentially exposing sensitive endpoints and parameter details.

The issue affects installations of Lychee provided by LycheeOrg before version 7.7.0. Any deployment of Lychee that has not been upgraded to the 7.7.0 release or later is vulnerable.

The CVSS score of 6.9 classifies the flaw as moderate severity. The EPSS score of less than 1% indicates a low likelihood of exploitation in the wild, and the vulnerability is not included in the CISA KEV catalog. A remote attacker can exploit the exposed route via standard HTTP GET requests, repeatedly triggering unthrottled regeneration of the schema to exhaust server CPU resources and gather detailed API information.