API Security Vulnerability in Changedetection.io Settings Handler

CVE-2026-71204

What is CVE-2026-71204?

The settings save handler in Changedetection.io processes form data improperly, allowing for sensitive information exposure. When a checkbox is unchecked, it is represented as 'False' instead of 'unchanged', which could unintentionally disable the API key enforcement if the api_access_token_enabled field is omitted in requests. This flaw enables unauthenticated users to gain access to the full watch list, history, and configurations, undermining the intended security measures.

References