CVE-2026-71203
Received Received - Intake

Unauthenticated Access to OpenAPI Schema in changedetection.io

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get() method carries neither @auth.check_token nor @validate_openapi_request. An unauthenticated client can retrieve the full merged OpenAPI schema (all endpoint paths, parameters, and registered processor plugins) even when API access control is enabled and every sibling /api/v1/* route correctly requires the key.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71203
EUVD
EUVD-2026-53200

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dgtlmoon changedetection.io *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in changedetection.io's REST API. The /api/v1/full-spec endpoint exposes the full OpenAPI schema without requiring an API key, allowing unauthenticated users to view all endpoint paths, parameters, and processor plugins even when API access control is enabled elsewhere.

Detection Guidance

Check if unauthenticated requests to /api/v1/full-spec return OpenAPI schema details. Use curl to test: curl -X GET http://<target>/api/v1/full-spec. If the response includes endpoint paths or plugin details without requiring an API key, the system is vulnerable.

Impact Analysis

An attacker could use this to map the API structure, identify sensitive endpoints, and potentially exploit other vulnerabilities. It leaks internal API details that should remain hidden, increasing attack surface without direct system access.

Compliance Impact

The vulnerability exposes the full OpenAPI schema, including all endpoint paths and parameters, which could reveal sensitive API details. This may violate data protection requirements under GDPR or HIPAA if the exposed information relates to protected health or personal data processing.

Mitigation Strategies

Apply the latest patch from changedetection.io to enforce @auth.check_token on the Spec resource. Alternatively, restrict access to /api/v1/full-spec via firewall rules or disable the endpoint if not needed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71203. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart