What is the CVSS score of CVE-2026-71204?

CVE-2026-71204 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.2%.

changedetection.io CVE-2026-71204

EUVD-2026-53201 MEDIUM

Improper Access Control (CWE-284)

2026-08-05 TuranSec

GHSA-84vg-9r54-xpgh

Authentication Bypass Changedetection Io Dgtlmoon

6.2

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

6.2 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L

vuln.today AI

7.9 HIGH

Scope changed to C because disabling API auth grants unauthenticated access beyond the triggering session; PR:H and AC:H retained as the exploit requires a privileged session and deliberate field omission.

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

CVSS changed

Aug 05, 2026 - 08:22 NVD

6.3 (MEDIUM) 6.2 (MEDIUM)

Analysis Generated

Aug 05, 2026 - 08:08 vuln.today

DescriptionCVE.org

changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update(). Because WTForms represents an unchecked checkbox as False rather than 'unchanged', and only the 'password' field is special-cased against this problem, a POST to /settings that omits the api_access_token_enabled field (e.g. a minimal scripted request) silently disables API key enforcement for the entire REST API, exposing the full watch list, history, and configuration to unauthenticated requests.

AnalysisAI

Authentication bypass in changedetection.io's /settings endpoint silently disables REST API key enforcement when a privileged user or script submits a minimal POST request that omits the api_access_token_enabled checkbox. Because WTForms encodes an unchecked checkbox as False and the settings handler blindly merges all form fields via .update(), the API access token requirement is cleared without any warning, exposing the full watch list, history, and application configuration to unauthenticated REST API callers. No public exploit code or CISA KEV listing has been identified at time of analysis, but the post-exploitation surface - complete unauthenticated API access - is severe.

Technical ContextAI

changedetection.io (CPE: cpe:2.3:a:dgtlmoon:changedetection.io:*:*:*:*:*:*:*:*) is a Python-based open-source web page change detection application. Its /settings route uses the WTForms library to process form submissions. WTForms represents an HTML checkbox that is not included in a POST body as a boolean False rather than preserving the stored value, because HTTP omits unchecked checkboxes entirely. The settings handler constructs an update dictionary directly from form.data['application'] and applies it via Python's dict .update() method without validating which fields should be mutable or merging only explicitly submitted fields. This constitutes CWE-284 (Improper Access Control): the access control state (api_access_token_enabled) is writeable via an indirect, unintended data path. The 'password' field is already special-cased against this exact problem, confirming developer awareness of the pattern, but api_access_token_enabled was not similarly protected.

RemediationAI

No vendor-released patched version has been independently confirmed from the available data - the sole reference is the project GitHub repository at https://github.com/dgtlmoon/changedetection.io, which should be monitored for a fix commit or tagged release that special-cases api_access_token_enabled in the same manner as the existing 'password' field guard. As a compensating control, administrators should verify the api_access_token_enabled setting is True after any /settings save operation and rotate the API access token immediately if it is found disabled unexpectedly. Restricting network access to the changedetection.io web interface and REST API to trusted IP ranges or placing the instance behind a VPN or authenticated reverse proxy reduces the blast radius of the post-exploitation state. Disabling the REST API entirely (if not in use) eliminates the unauthenticated exposure surface. Audit server logs for unexpected unauthenticated REST API requests, which would indicate the setting was silently cleared.