Every CVE Search/ Get API key

CVE-2024-23329

changedetection.io API endpoint is not secured with API token

3.7 LowFix available

changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint /api/v1/watch/<uuid>/history can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal. This issue has been addressed in version 0.45.13. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.59%Up 0.5 points since Jan 24, 2024
90%50%10%1%

What each source reports

CVE List Score used 3.7

changedetection.io API endpoint is not secured with API token

changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint /api/v1/watch/<uuid>/history can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal. This issue has been addressed in version 0.45.13. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2024-23329
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2024-0021 3.7

changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint /api/v1/watch/<uuid>/history can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal. This issue has been addressed in version 0.45.13. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
EUVD-2024-0021
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-hcvp-2cc7-jrwr 1.7

changedetection.io API endpoint is not secured with API token

Summary

API endpoint /api/v1/watch/<uuid>/history can be accessed by any unauthorized user.

Details

WatchHistory resource does not have @auth.check_token annotation, which means it can be accessed without providing x-api-key header.

https://github.com/dgtlmoon/changedetection.io/blob/9510345e01ea8e308c339163d8e8b030ce5ac7f1/changedetectionio/api/api_v1.py#L129-L156

PoC

  1. Get list of watch with x-api-key:
$ curl -H "x-api-key: apikeyhere" http://localhost:5000/api/v1/watch
{"uuid": ...}
  1. Call for history of snapshots without x-api-key. Expected - 401/403 error. Actual - list of snapshots is listed.
$ curl http://localhost:5000/api/v1/watch/uuid/history
{"timestamp": "/path/to/snapshot.txt"}

Impact

Anybody can check one's watch history. However, because unauthorized party first needs to know watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal.

Record
GHSA-hcvp-2cc7-jrwr
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02
NVD 3.7

changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint /api/v1/watch/<uuid>/history can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal. This issue has been addressed in version 0.45.13. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2024-23329
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02
OSV 3.7

changedetection.io API endpoint is not secured with API token

changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint /api/v1/watch/<uuid>/history can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal. This issue has been addressed in version 0.45.13. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2024-23329
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02
OSVGHSA-hcvp-2cc7-jrwr 1.7

changedetection.io API endpoint is not secured with API token

Summary

API endpoint /api/v1/watch/<uuid>/history can be accessed by any unauthorized user.

Details

WatchHistory resource does not have @auth.check_token annotation, which means it can be accessed without providing x-api-key header.

https://github.com/dgtlmoon/changedetection.io/blob/9510345e01ea8e308c339163d8e8b030ce5ac7f1/changedetectionio/api/api_v1.py#L129-L156

PoC

  1. Get list of watch with x-api-key:
$ curl -H "x-api-key: apikeyhere" http://localhost:5000/api/v1/watch
{"uuid": ...}
  1. Call for history of snapshots without x-api-key. Expected - 401/403 error. Actual - list of snapshots is listed.
$ curl http://localhost:5000/api/v1/watch/uuid/history
{"timestamp": "/path/to/snapshot.txt"}

Impact

Anybody can check one's watch history. However, because unauthorized party first needs to know watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal.

Record
GHSA-hcvp-2cc7-jrwr
CVSS 4.0
1.7 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02
OSVPYSEC-2024-15 3.7

changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint /api/v1/watch/<uuid>/history can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal. This issue has been addressed in version 0.45.13. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
PYSEC-2024-15
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
changedetection-io
PyPI
 0.39.14 to 0.45.12
0.45.13
changedetection-io
PyPI
 0.39.14 up to 0.45.13, plus listed versions
0.39.14.10.39.150.39.160.39.170.39.17.1
Show 45 moreShow less
0.39.17.20.39.180.39.190.39.19.10.39.200.39.20.10.39.20.20.39.20.30.39.20.40.39.210.39.21.10.39.220.39.22.10.40.00.40.0.10.40.0.20.40.0.30.40.0.40.40.1.00.40.1.10.40.20.40.30.410.41.10.420.42.10.42.20.42.30.43.10.43.20.440.44.10.450.45.10.45.110.45.120.45.20.45.30.45.40.45.50.45.60.45.70.45.7.10.45.7.20.45.7.3
0.45.13

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-23329 is a low vulnerability (CVSS 3.7) in Dgtlmoon Changedetection.io, published January 19, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in changedetection-io 0.45.13.

References

This page doesn't list everything

Left out here: 3 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open