CVE-2026-71204 Details
Description
changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.
A vulnerability in changedetection.io's settings save handler allows for the silent disabling of API key enforcement across the REST API. This issue arises because WTForms treats unchecked checkboxes as False, rather than 'unchanged'. Only the 'password' field is exempt from this behavior. As a result, a minimal POST request to the /settings endpoint that excludes the api_access_token_enabled field can inadvertently disable API key enforcement. This oversight exposes the user's entire watch list, history, and configuration to unauthenticated requests.
Users can manually ensure that the api_access_token_enabled field is included in their settings to maintain API key enforcement. Regularly updating to the latest version of changedetection.io is also recommended, as this vulnerability may be addressed in future releases.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dgtlmoon/changedetection.io | TuranSec | ProductSource CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| dgtlmoon changedetection.io | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | TuranSec |