{"id":"CVE-2026-71203","aliases":["EUVD-2026-53200","GHSA-9vx6-gpfr-5qq7"],"status":"published","title":"changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema","description":"changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00313,"percentile":0.24399,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-306"],"published":"2026-08-05T06:58:56Z","modified":"2026-10-28T02:31:05Z","exploits":[{"source":"pocgithub","id":"Nel-droid/CVE-2026-71203-PoC","title":"Nel-droid/CVE-2026-71203-PoC","date":"2026-08-16","url":"https://github.com/Nel-droid/CVE-2026-71203-PoC"}],"products":[{"vendor":"dgtlmoon","product":"changedetection.io"}],"references":[{"url":"https://github.com/dgtlmoon/changedetection.io","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71203","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9vx6-gpfr-5qq7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71203.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-71203","title":"changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema","description":"changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.","status":"published","published":"2026-08-05T06:58:56.911Z","modified":"2026-08-10T11:45:01.129Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:19:49.559463Z"}],"euvd":[{"id":"EUVD-2026-53200","description":"changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.","status":"published","published":"2026-08-05T06:58:56Z","modified":"2026-08-10T11:45:01Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:06.086083Z"}],"ghsa":[{"id":"GHSA-9vx6-gpfr-5qq7","title":"changedetection.io's REST API resources are protected by an @auth.check_token decorator...","description":"changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get() method carries neither @auth.check_token nor @validate_openapi_request. An unauthenticated client can retrieve the full merged OpenAPI schema (all endpoint paths, parameters, and registered processor plugins) even when API access control is enabled and every sibling /api/v1/* route correctly requires the key.","status":"published","published":"2026-08-05T09:31:18Z","modified":"2026-08-05T09:31:27Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:10:06.632203Z"}],"nvd":[{"id":"CVE-2026-71203","description":"changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.","status":"published","published":"2026-08-05T08:16:42.203Z","modified":"2026-10-24T15:10:00.19Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:12:35.031043Z"}],"osv":[{"id":"CVE-2026-71203","title":"changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema","description":"changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.","status":"published","published":"2026-08-05T06:58:56.911Z","modified":"2026-10-28T02:31:05.417464855Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:45:15.164658Z"}]}}