CVE-2026-71204
Received Received - Intake

API Key Bypass in ChangeDetection.io via Missing Field

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update(). Because WTForms represents an unchecked checkbox as False rather than 'unchanged', and only the 'password' field is special-cased against this problem, a POST to /settings that omits the api_access_token_enabled field (e.g. a minimal scripted request) silently disables API key enforcement for the entire REST API, exposing the full watch list, history, and configuration to unauthenticated requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71204
EUVD
EUVD-2026-53201

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dgtlmoon changedetection.io *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in changedetection.io allows an attacker to disable API key enforcement by sending a crafted POST request to the /settings endpoint without including the api_access_token_enabled field. The application blindly merges form data into settings, and unchecked checkboxes are treated as False, which disables API access restrictions and exposes sensitive data like watch lists and configurations to unauthenticated users.

Detection Guidance

Check if API key enforcement is disabled by sending a request to /settings and verifying if api_access_token_enabled is missing or set to False. Inspect network logs for unauthorized access to /api endpoints.

Impact Analysis

An attacker could exploit this to gain unauthorized access to the full REST API, retrieve sensitive watch lists, view historical data, and modify configurations without authentication. This could lead to data breaches, unauthorized changes, or further compromise of the system.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR (data protection) and HIPAA (health information privacy) by exposing sensitive data to unauthorized parties. Unauthorized access to watch lists or configurations may result in regulatory penalties, loss of trust, and legal consequences.

Mitigation Strategies

Update changedetection.io to the latest version that patches this issue. Ensure all settings POST requests include the api_access_token_enabled field explicitly set to True to prevent silent disabling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71204. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart