CVE-2026-71203

Name of the Vulnerable Software and Affected Versions changedetection.io (affected versions not specified)

Description The REST API resources are protected by an @auth.check token decorator that validates the x-api-key header. However, the Spec resource registered at the '/api/v1/full-spec' endpoint lacks both the @auth.check token and @validate openapi request decorators in its get() method. This allows an unauthenticated client to retrieve the full merged OpenAPI schema, including all endpoint paths, parameters, and registered processor plugins, even when API access control is enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.