CVE-2026-71203: changedetection.io Auth Bypass Vulnerability

CVE-2026-71203 Overview

CVE-2026-71203 is an information disclosure vulnerability in changedetection.io, an open-source web page change monitoring tool. The /api/v1/full-spec endpoint, registered in changedetectionio/api/Spec.py, omits the @auth.check_token decorator applied to every other REST API resource. An unauthenticated remote attacker can retrieve the full merged OpenAPI schema, exposing all endpoint paths, parameters, and registered processor plugins even when API access control is enabled. The flaw is categorized as Missing Authentication for Critical Function [CWE-306].

Critical Impact
Unauthenticated network attackers can enumerate the complete API surface of a protected changedetection.io instance, aiding reconnaissance for further attacks against the application.

Affected Products

changedetection.io (open-source web change monitoring application)
Deployments exposing the REST API where API access control is enabled
Instances using the Spec resource at /api/v1/full-spec

Discovery Timeline

2026-08-05 - CVE-2026-71203 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71203

Vulnerability Analysis

changedetection.io protects its REST API resources with an @auth.check_token decorator that validates the caller's x-api-key header. The decorator is applied consistently across /api/v1/* routes, ensuring only clients presenting a valid API key can invoke them. The Spec resource registered at /api/v1/full-spec in changedetectionio/api/Spec.py breaks this pattern. Its get() method carries neither @auth.check_token nor @validate_openapi_request, leaving the endpoint unauthenticated. The exposed OpenAPI document reveals every registered route, request parameter, and processor plugin loaded by the instance. This gives an attacker a full map of the application's attack surface without needing credentials. The exposure conflicts with the operator's expectation that enabling API access control gates all API responses.

Root Cause

The root cause is a missing authentication decorator on a single Flask resource method [CWE-306]. Because access control is applied per-decorator rather than at a central middleware layer, any route registered without the decorator silently bypasses authentication.

Attack Vector

Exploitation requires only network access to the changedetection.io instance. An attacker issues an HTTP GET request to /api/v1/full-spec without any x-api-key header and receives the merged OpenAPI schema in the response. No authentication, user interaction, or elevated privileges are required. See the changedetection.io GitHub repository for source-level context on the Spec.py resource and its sibling API modules.

Detection Methods for CVE-2026-71203

Indicators of Compromise

Unauthenticated HTTP GET requests to /api/v1/full-spec in web server or reverse proxy access logs.
Requests to /api/v1/full-spec missing the x-api-key header returning HTTP 200 responses.
Follow-up scanning of API endpoints enumerated from the leaked OpenAPI schema, often from the same source IP.

Detection Strategies

Alert on any successful response to /api/v1/full-spec that does not include an x-api-key request header.
Correlate access to /api/v1/full-spec with subsequent bursts of requests against other /api/v1/* routes from the same client.
Baseline expected API consumers by IP or key and flag anonymous callers hitting the spec endpoint.

Monitoring Recommendations

Ingest reverse proxy and application logs into a centralized log platform and retain full request headers.
Monitor for external scanners probing /api/v1/full-spec on internet-exposed changedetection.io hosts.
Track anomalous spikes in API traffic volume or endpoint diversity following spec retrieval.

How to Mitigate CVE-2026-71203

Immediate Actions Required

Restrict network access to changedetection.io API endpoints using a firewall, reverse proxy allowlist, or VPN.
Block or authenticate /api/v1/full-spec at the reverse proxy layer until an upstream fix is applied.
Rotate any API keys used on internet-facing instances and audit recent access logs for reconnaissance activity.

Patch Information

At the time of publication, no fixed version is listed in the NVD entry. Monitor the changedetection.io GitHub repository for a commit adding @auth.check_token to the Spec resource get() method and upgrade once released.

Workarounds

Deploy a reverse proxy rule that denies unauthenticated requests to /api/v1/full-spec while permitting other routes to reach the application.
Disable or restrict the REST API entirely if the OpenAPI specification is not required by downstream consumers.
Place the changedetection.io instance behind an authenticating gateway that enforces API keys or mTLS at the network edge.

bash

# Example nginx location block to block unauthenticated access to the spec endpoint
location = /api/v1/full-spec {
    if ($http_x_api_key = "") {
        return 401;
    }
    proxy_pass http://changedetection_upstream;
}