CVE-2026-71203 — changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema

CVE-2026-71203

changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema PUBLISHED

Description (CNA)

changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.

Affected (CNA)

Vendor / product	Versions
dgtlmoon / changedetection.io	affected 0.55.7

CWE

CWE-306

References

https://github.com/dgtlmoon/changedetection.io

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.