Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-71203

changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema

Description

changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

dgtlmoon changedetection.io

Default version status: unknown

  • 0.55.7affected

References