Access Control Bypass Vulnerability in Changedetection.io's REST API

CVE-2026-71203

What is CVE-2026-71203?

An access control bypass vulnerability exists in Changedetection.io's REST API, where the Spec resource at /api/v1/full-spec is improperly secured. Unlike other API endpoints that enforce token validation through an @auth.check_token decorator, the Spec resource lacks such protection, allowing unauthenticated clients to access the complete OpenAPI schema. This oversight poses significant risks, as sensitive information regarding endpoint paths, parameters, and processor plugins can be exposed, undermining API security measures.

References