CVE-2026-71204

MEDIUM 6.3

changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.

CWE	CWE-284
Vendor	dgtlmoon
Product	changedetection.io
Published	Aug 5, 2026
Last Updated	Aug 10, 2026

Stay Ahead of the Next One

Get instant alerts for dgtlmoon changedetection.io

Be the first to know when new medium vulnerabilities affecting dgtlmoon changedetection.io are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Affected Versions

dgtlmoon / changedetection.io

0.55.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/dgtlmoon/changedetection.io

Credits

Eldor Nabijonov