MEDIUM 5.3 NVD

CVE-2026-71203

changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource regis

changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get() method carries neither @auth.check_token nor @validate_openapi_request. An unauthenticated client can retrieve the full merged OpenAPI schema (all endpoint paths, parameters, and registered processor plugins) even when API access control is enabled and every sibling /api/v1/* route correctly requires the key.

References

https://github.com/dgtlmoon/changedetection.io

Published: 2026-08-05 · Source: NVD · Feed updated: 2026-08-05

This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-08-05 via NVD.

vulnfeed aggregates 9225 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.