CVE-2026-71203

changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.26% chance of exploitation in the next 30 days, 17th percentile

Published

2026-08-05

Updated

2026-08-10

Proof-of-concept exploits (1)

• Nel-droid/CVE-2026-71203-PoC0★ · 2026-08-16

References

• CVE Record
• NVD entry

Related

• CVE-2026-71204
• CVE-2026-71205
• CVE-2026-71206
• CVE-2026-7119
• CVE-2026-7118
• CVE-2026-7117