changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetec…

Medium CVSS 5.3

CVECVE-2026-71203

First seen2026-08-10 13:15 UTC

Disclosed2026-08-05 08:16 UTC

Last updated2026-08-10 13:15 UTC

Channel statusauto

Summary

changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.

In-depth triage · Auto channel

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Sources

NVD DATABASE

Original Links

https://github.com/dgtlmoon/changedetection.io

Timeline

2026-08-10 nvd_ingest NVD