CyberRota Analysis
AI-GeneratedThe vulnerability exists in changedetection.io's REST API, specifically in the Spec resource at /api/v1/full-spec, which lacks proper authentication checks. This oversight allows unauthenticated clients to access the complete OpenAPI schema, exposing sensitive endpoint information and processor plugins. Organizations using changedetection.io should prioritize this issue to mitigate potential information leakage and unauthorized access risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.