What is the CVSS score of EUVD-2026-53200?

EUVD-2026-53200 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

changedetection.io EUVD-2026-53200

| CVE-2026-71203 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-08-05 TuranSec

GHSA-9vx6-gpfr-5qq7

Authentication Bypass Changedetection Io Dgtlmoon

5.3

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible endpoint requires no authentication or user interaction; impact is schema-only disclosure, so C:L with I:N and A:N is appropriate.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 08:07 vuln.today

DescriptionCVE.org

changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get() method carries neither @auth.check_token nor @validate_openapi_request. An unauthenticated client can retrieve the full merged OpenAPI schema (all endpoint paths, parameters, and registered processor plugins) even when API access control is enabled and every sibling /api/v1/* route correctly requires the key.

AnalysisAI

Unauthenticated retrieval of the full OpenAPI schema is possible in changedetection.io because the /api/v1/full-spec endpoint in changedetectionio/api/Spec.py lacks the @auth.check_token decorator that protects every other /api/v1/* route. Any network-reachable attacker can issue a plain GET request to this path and receive the complete merged schema - all endpoint paths, accepted parameters, and registered processor plugins - even when API key enforcement is active across all sibling routes. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, though the attack requires zero prerequisites beyond network access, making opportunistic reconnaissance trivially achievable.

Technical ContextAI

changedetection.io is an open-source, self-hosted web-change monitoring application written in Python (Flask). Its REST API uses a decorator pattern - @auth.check_token - to enforce x-api-key header validation on each registered resource. The Spec resource, defined in changedetectionio/api/Spec.py and mounted at /api/v1/full-spec, exposes the merged OpenAPI/Swagger schema for the entire API surface. Its get() method omits both @auth.check_token and @validate_openapi_request, deviating from the uniform protection applied to every sibling route. The root cause maps to CWE-306 (Missing Authentication for Critical Function): a discrete, operationally significant endpoint was excluded from the access-control mechanism that governs the rest of the API, creating an inconsistency exploitable without any credentials. The CPE wildcard cpe:2.3:a:dgtlmoon:changedetection.io:*:*:*:*:*:*:*:* indicates no version was exempt from this oversight.

RemediationAI

The definitive fix is to add the @auth.check_token decorator to the get() method of the Spec resource in changedetectionio/api/Spec.py, bringing it in line with all other /api/v1/* routes. Monitor the upstream GitHub repository at https://github.com/dgtlmoon/changedetection.io for a tagged release that includes this change; no exact patched version number was available at time of analysis. As an immediate compensating control, restrict network access to the changedetection.io instance using firewall rules or reverse-proxy IP allowlisting so that only trusted hosts can reach any /api/v1/ path - this eliminates the network attack vector with no application-level side effects. Alternatively, configure a reverse proxy (nginx, Caddy, Traefik) to return 401 or 403 on requests to /api/v1/full-spec specifically, as a targeted path-level block; note this blocks legitimate schema browsing tools but does not affect API functionality. If the instance does not need to be internet-facing, binding it to localhost or a private interface is the simplest and most effective mitigation.