API Key Bypass in ChangeDetection.io via Missing Field

Executive Summary

This vulnerability in changedetection.io allows an attacker to disable API key enforcement by sending a crafted POST request to the /settings endpoint without including the api_access_token_enabled field. The application blindly merges form data into settings, and unchecked checkboxes are treated as False, which disables API access restrictions and exposes sensitive data like watch lists and configurations to unauthenticated users.

Useful 0 Not Useful 0

Detection Guidance

Check if API key enforcement is disabled by sending a request to /settings and verifying if api_access_token_enabled is missing or set to False. Inspect network logs for unauthorized access to /api endpoints.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain unauthorized access to the full REST API, retrieve sensitive watch lists, view historical data, and modify configurations without authentication. This could lead to data breaches, unauthorized changes, or further compromise of the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR (data protection) and HIPAA (health information privacy) by exposing sensitive data to unauthorized parties. Unauthorized access to watch lists or configurations may result in regulatory penalties, loss of trust, and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Update changedetection.io to the latest version that patches this issue. Ensure all settings POST requests include the api_access_token_enabled field explicitly set to True to prevent silent disabling.

Useful 0 Not Useful 0