CVE-2026-71203

changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.

Score

CVSS 3.1 5.3 Medium

Status

Deferred - 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Published

2026-08-05

Last modified

2026-10-24

Weaknesses

CWE-306

Affected products

• Changedetection.io (Dgtlmoon)

References

• https://github.com/dgtlmoon/changedetection.io