CyberRota Analysis
AI-GeneratedThe vulnerability arises from the way changedetection.io handles form data during the settings update process, allowing an attacker to disable API key enforcement by omitting the `api_access_token_enabled` field in a POST request. This oversight can lead to unauthorized access to sensitive information, including the full watch list, history, and configuration, exposing the application to potential data breaches. Organizations using changedetection.io should prioritize patching this issue to safeguard their data against unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.