CVE-2026-71204 in Changedetection.io
Summary
by MITRE • 08/05/2026
changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update(). Because WTForms represents an unchecked checkbox as False rather than 'unchanged', and only the 'password' field is special-cased against this problem, a POST to /settings that omits the api_access_token_enabled field (e.g. a minimal scripted request) silently disables API key enforcement for the entire REST API, exposing the full watch list, history, and configuration to unauthenticated requests.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability in changedetection.io's settings handler represents a critical security flaw that stems from improper input validation and blind merging of user-supplied data into application configuration. This issue occurs within the /settings save endpoint where form data is processed through WTForms and subsequently merged into stored application settings using the dictionary update() method without proper sanitization. The core technical problem arises because WTForms treats unchecked checkboxes as boolean False values rather than maintaining their previous state, creating a scenario where omission of certain fields during configuration updates results in unintended default behavior.
The operational impact of this vulnerability is severe and directly exposes the entire application to unauthorized access. When a POST request to /settings omits the api_access_token_enabled field, the system silently merges this missing value as False into the current settings, effectively disabling API key enforcement for the complete REST API interface. This action removes all authentication barriers that protect sensitive data including watch lists, historical records, and full configuration details, making them accessible to any unauthenticated user who can reach the application's endpoints. The vulnerability is particularly dangerous because it operates silently without alerting administrators to the change in security posture.
This flaw demonstrates multiple weaknesses in the application's security architecture and data handling practices. The issue aligns with CWE-254, which addresses 'Effective Access Control' problems where insufficient validation allows unauthorized access. From an ATT&CK perspective, this vulnerability enables T1078 'Valid Accounts' and T1190 'Exploitation of Remote Services' techniques by allowing attackers to bypass authentication mechanisms through configuration manipulation. The blind merging approach used in the update handler creates a path for privilege escalation and information disclosure that directly violates security best practices for configuration management.
The vulnerability is exacerbated by the incomplete mitigation approach where only the 'password' field receives special handling, while other critical configuration parameters remain unprotected. This selective treatment suggests either oversight during development or insufficient understanding of the broader implications of unchecked data merging. The minimal nature of the exploit makes it particularly dangerous as attackers can disable security features through simple scripted requests without requiring complex exploitation techniques. Organizations should immediately implement proper input validation that explicitly handles omitted fields and ensures all configuration parameters maintain their intended security states during updates.
Recommended mitigations include implementing comprehensive field validation that explicitly checks for presence of critical security parameters in update requests, adding explicit handling for boolean fields that may be omitted from user inputs, and ensuring that all configuration updates require explicit confirmation of intended state changes. The application should also implement logging of configuration changes to detect unauthorized modifications and establish proper default security settings that cannot be silently overridden through simple form submissions. Additionally, the system should validate that critical security parameters maintain their expected values during update operations rather than blindly accepting user-provided data.