Changedetection Io
Monthly
Arbitrary local file disclosure in ChangeDetection.io versions before 0.54.7 allows authenticated attackers to read sensitive files from the server filesystem by exploiting incomplete XPath function blocklist. The vulnerability stems from unblocked XPath 3.0/3.1 functions like json-doc() that bypass SafeXPath3Parser protections. EPSS score of 0.05% indicates low likelihood of widespread exploitation. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck with vendor patch released in version 0.54.7.
Unrestricted brute-force against changedetection.io's /login endpoint allows a remote unauthenticated attacker to systematically guess the single shared application password with no throttling, lockout, or attempt counter to impede automated attacks. Because the entire application is protected by one shared credential with no per-user account model, a successful guess grants full administrative control - including the ability to view and regenerate the API token and access all monitored URL configurations. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivially automatable given the network-accessible endpoint, low complexity (CVSS AC:L), and complete absence of brute-force controls confirmed by requirements.txt inspection.
Authentication bypass in changedetection.io's /settings endpoint silently disables REST API key enforcement when a privileged user or script submits a minimal POST request that omits the api_access_token_enabled checkbox. Because WTForms encodes an unchecked checkbox as False and the settings handler blindly merges all form fields via .update(), the API access token requirement is cleared without any warning, exposing the full watch list, history, and application configuration to unauthenticated REST API callers. No public exploit code or CISA KEV listing has been identified at time of analysis, but the post-exploitation surface - complete unauthenticated API access - is severe.
Unauthenticated retrieval of the full OpenAPI schema is possible in changedetection.io because the /api/v1/full-spec endpoint in changedetectionio/api/Spec.py lacks the @auth.check_token decorator that protects every other /api/v1/* route. Any network-reachable attacker can issue a plain GET request to this path and receive the complete merged schema - all endpoint paths, accepted parameters, and registered processor plugins - even when API key enforcement is active across all sibling routes. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, though the attack requires zero prerequisites beyond network access, making opportunistic reconnaissance trivially achievable.
Arbitrary local file disclosure in ChangeDetection.io versions before 0.54.7 allows authenticated attackers to read sensitive files from the server filesystem by exploiting incomplete XPath function blocklist. The vulnerability stems from unblocked XPath 3.0/3.1 functions like json-doc() that bypass SafeXPath3Parser protections. EPSS score of 0.05% indicates low likelihood of widespread exploitation. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck with vendor patch released in version 0.54.7.
Unrestricted brute-force against changedetection.io's /login endpoint allows a remote unauthenticated attacker to systematically guess the single shared application password with no throttling, lockout, or attempt counter to impede automated attacks. Because the entire application is protected by one shared credential with no per-user account model, a successful guess grants full administrative control - including the ability to view and regenerate the API token and access all monitored URL configurations. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivially automatable given the network-accessible endpoint, low complexity (CVSS AC:L), and complete absence of brute-force controls confirmed by requirements.txt inspection.
Authentication bypass in changedetection.io's /settings endpoint silently disables REST API key enforcement when a privileged user or script submits a minimal POST request that omits the api_access_token_enabled checkbox. Because WTForms encodes an unchecked checkbox as False and the settings handler blindly merges all form fields via .update(), the API access token requirement is cleared without any warning, exposing the full watch list, history, and application configuration to unauthenticated REST API callers. No public exploit code or CISA KEV listing has been identified at time of analysis, but the post-exploitation surface - complete unauthenticated API access - is severe.
Unauthenticated retrieval of the full OpenAPI schema is possible in changedetection.io because the /api/v1/full-spec endpoint in changedetectionio/api/Spec.py lacks the @auth.check_token decorator that protects every other /api/v1/* route. Any network-reachable attacker can issue a plain GET request to this path and receive the complete merged schema - all endpoint paths, accepted parameters, and registered processor plugins - even when API key enforcement is active across all sibling routes. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, though the attack requires zero prerequisites beyond network access, making opportunistic reconnaissance trivially achievable.