CVE-2026-71203: changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-05 · updated 2026-10-24
Weakness: CWE-306

Description

changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.

Affected products

dgtlmoon changedetection.io: 0.55.7

References

https://github.com/dgtlmoon/changedetection.io

Get alerted when CVE-2026-71203 or the next vulnerability affects your stack