CVE-2026-71204— changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| dgtlmoon | changedetection.io | 0.55.7 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-71204
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement
Source: CVE Program / CVE List V5
Vulnerability Description
changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
dgtlmoon changedetection.io 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
dgtlmoon changedetection.io是dgtlmoon个人开发者开源的一款网站变更检测与安全监控平台。 dgtlmoon changedetection.io 0.55.7版本存在权限许可和访问控制问题漏洞，该漏洞源于/settings保存处理器从form.data['application']构建更新字典并盲目合并到存储的应用程序设置中，当POST请求省略api_access_token_enabled字段时，未选中的复选框被表示为False，导致静默禁用API密钥强制，将完整的监视列
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| dgtlmoon | changedetection.io | 0.55.7 | - |
II. Public POCs for CVE-2026-71204
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-71204
请登录查看更多情报信息。
Other References for CVE-2026-71204 (1)
Same Patch Batch · dgtlmoon · 2026-08-05 · 3 CVEs total
| CVE-2026-71205 | 6.5 MEDIUM | changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force |
| CVE-2026-71203 | 5.3 MEDIUM | changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Sc |
IV. Related Vulnerabilities
Same product: changedetection.io
- CVE-2026-71205
changedetection.io - No Rate Limiting on /login Enables Unli - CVE-2026-71203
changedetection.io - Missing Authentication on /api/v1/full- - CVE-2026-43891
changedetection.io: Arbitrary Local File Read via crafted ba - CVE-2026-41895
changedetection.io: XXE vulnerability in the changedetection - CVE-2026-35490
changedetection.io has an Authentication Bypass via Decorato
Same vendor: dgtlmoon
- CVE-2026-71205
changedetection.io - No Rate Limiting on /login Enables Unli - CVE-2026-71203
changedetection.io - Missing Authentication on /api/v1/full- - CVE-2026-43891
changedetection.io: Arbitrary Local File Read via crafted ba - CVE-2026-41895
changedetection.io: XXE vulnerability in the changedetection - CVE-2026-35490
changedetection.io has an Authentication Bypass via Decorato
Same weakness: CWE-284
- CVE-2026-73061
Scriban before 7.2.2 Arbitrary Property Write via TypedObjec - CVE-2026-19918
SpaceX Starlink Router Gen 3 gRPC Management get_status acce - CVE-2026-71570
Joomla Extension - icagenda.com - ACL bypass allowing arbitr - CVE-2026-19835
Webkul Bagisto Customer Item Deletion Endpoint access contro - CVE-2026-72837
File Browser before 2.63.20 Privilege Escalation via Proxy A
V. Comments for CVE-2026-71204
No comments yet