CVE-2026-71204

Name of the Vulnerable Software and Affected Versions changedetection.io (affected versions not specified)

Description The /settings save handler creates an update dictionary from form.data['application'] and merges it into the stored application settings using the .update() method. Due to how WTForms handles unchecked checkboxes as False instead of unchanged, and because only the password field is protected against this behavior, a POST request to the /settings endpoint that omits the api access token enabled variable can silently disable API key enforcement. This allows unauthenticated requests to access the full watch list, history, and configuration of the REST API.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.