CVE-2026-71203
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In changedetection.io, REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec, whose get method carries neither @auth.check_token nor @validate_openapi_request.
Risk Assessment
An unauthenticated attacker could access the full API specification, potentially revealing technical details and facilitating further attacks.
Recommendation
Add the @auth.check_token decorator to the Spec resource's get method and consider adding OpenAPI validation.
Other vulnerabilities in changedetection.io
See all- CVE-2026-43891High
In the changedetection.io web page change detection tool prior to version 0.55.1, a vulnerability exists due to trusting attacker-controlled snapshot paths restored from backup files. When a backup is restored, the application may restore malicious files, including history.txt, leading to the disclosure of local file contents.
- CVE-2026-41895High
In versions 0.54.9 and earlier, changedetection.io switches to XML mode for XML/RSS content, leading to potential security issues related to processing untrusted XML data.
- CVE-2026-71205Medium
changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).
- CVE-2026-71204Medium
In changedetection.io, the /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.
- CVE-2026-35000Medium
A vulnerability in ChangeDetection.io before version 0.54.7 allows bypassing protections in the SafeXPath3Parser. Attackers can read arbitrary local files using unblocked XPath 3.0/3.1 functions like json-doc().
Original NVD description (English source)
changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.