CVE-2026-71203: changedetection.io: Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema
changedetection.io's REST API resources are protected by an @auth.checktoken decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get() method carries neither @auth.checktoken nor @validateopenapirequest. An unauthenticated client can retrieve the full merged OpenAPI schema (all endpoint paths, parameters, and registered processor plugins) even when API access control is enabled and every sibling /api/v1/ route correctly requires the key.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add the missing @auth.check_token decorator (and validation used by other resources) to the Spec.get() handler serving /api/v1/full-spec so that the x-api-key header is required when retrieving the OpenAPI schema.
changedetection.io REST API (changedetectionio/api/Spec.py Spec resource) Authentication on GET /api/v1/full-spec = Require x-api-key validated by @auth.check_token (add @auth.check_token decorator to Spec.get()) - Configuration
Ensure /api/v1/full-spec is protected exactly like the other /api/v1/* routes by enforcing the required API key and request validation (the sibling routes already require the key; the Spec resource currently does not).
changedetection.io REST API (Spec endpoint) Authorization enforcement for OpenAPI schema exposure = Apply same request validation as other sibling /api/v1/* routes