CVE-2026-35490

changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, the @login_optionally_required decorator is placed before (outer to) @blueprint.route() instead of after it. In Flask, @route() must be the outermost decorator because it registers the function it receives. When the order is reversed, @route() registers the original undecorated function, and the auth wrapper is never in the call chain. This silently disables authentication on these routes. This vulnerability is fixed in 0.54.8.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-jmrh-xmgh-x9j4	Exploit Mitigation Vendor Advisory
https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-jmrh-xmgh-x9j4	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:webtechnologies:changedetection:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) changedetection.io es una herramienta gratuita de código abierto para la detección de cambios en páginas web. Antes de la 0.54.8, el decorador @login_optionally_required se coloca antes (externo a) @blueprint.route() en lugar de después. En Flask, @route() debe ser el decorador más externo porque registra la función que recibe. Cuando se invierte el orden, @route() registra la función original sin decorar, y el envoltorio de autenticación nunca está en la cadena de llamadas. Esto deshabilita silenciosamente la autenticación en estas rutas. Esta vulnerabilidad se corrige en la 0.54.8.

Information

Published : 2026-04-07 16:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-35490

Mitre link : CVE-2026-35490

CVE.ORG link : CVE-2026-35490

JSON object : View

Products Affected

webtechnologies

changedetection

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-35490", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35490", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-09T14:36:58.149739Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "dgtlmoon", "product": "changedetection.io", "versions": [{"status": "affected", "version": "< 0.54.8"}]}]}], "published": "2026-04-07T16:16:27.317", "references": [{"url": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-jmrh-xmgh-x9j4", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-jmrh-xmgh-x9j4", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, the @login_optionally_required decorator is placed before (outer to) @blueprint.route() instead of after it. In Flask, @route() must be the outermost decorator because it registers the function it receives. When the order is reversed, @route() registers the original undecorated function, and the auth wrapper is never in the call chain. This silently disables authentication on these routes. This vulnerability is fixed in 0.54.8."}, {"lang": "es", "value": "changedetection.io es una herramienta gratuita de c\u00f3digo abierto para la detecci\u00f3n de cambios en p\u00e1ginas web. Antes de la 0.54.8, el decorador @login_optionally_required se coloca antes (externo a) @blueprint.route() en lugar de despu\u00e9s. En Flask, @route() debe ser el decorador m\u00e1s externo porque registra la funci\u00f3n que recibe. Cuando se invierte el orden, @route() registra la funci\u00f3n original sin decorar, y el envoltorio de autenticaci\u00f3n nunca est\u00e1 en la cadena de llamadas. Esto deshabilita silenciosamente la autenticaci\u00f3n en estas rutas. Esta vulnerabilidad se corrige en la 0.54.8."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:webtechnologies:changedetection:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5DC2CEF9-816B-4070-9BAB-51B0EAAB7F5C", "versionEndExcluding": "0.54.8"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}