changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Dgtlmoon |
|
No data.
No data.
References
| Link | Providers |
|---|---|
| https://github.com/dgtlmoon/changedetection.io |
|
History
Mon, 10 Aug 2026 12:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Mon, 10 Aug 2026 12:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get() method carries neither @auth.check_token nor @validate_openapi_request. An unauthenticated client can retrieve the full merged OpenAPI schema (all endpoint paths, parameters, and registered processor plugins) even when API access control is enabled and every sibling /api/v1/* route correctly requires the key. | changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request. |
Mon, 10 Aug 2026 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | changedetection.io: Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema | changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema |
Wed, 05 Aug 2026 09:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Dgtlmoon
Dgtlmoon changedetection.io |
|
| Vendors & Products |
Dgtlmoon
Dgtlmoon changedetection.io |
Wed, 05 Aug 2026 07:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get() method carries neither @auth.check_token nor @validate_openapi_request. An unauthenticated client can retrieve the full merged OpenAPI schema (all endpoint paths, parameters, and registered processor plugins) even when API access control is enabled and every sibling /api/v1/* route correctly requires the key. | |
| Title | changedetection.io: Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema | |
| Weaknesses | CWE-306 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: TuranSec
Published: 2026-08-05T06:58:56.911Z
Updated: 2026-08-10T11:45:01.129Z
Reserved: 2026-08-05T06:56:15.798Z
Link: CVE-2026-71203
Vulnrichment
Updated: 2026-08-05T13:21:05.196Z
NVD
Status : Received
Published: 2026-08-05T08:16:42.203
Modified: 2026-08-10T12:17:24.040
Link: CVE-2026-71203
Redhat
No data.