https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:01:15 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-71203 <p>changedetection.io&#39;s REST API resources are protected by an @auth.check_token decorator validating the caller&#39;s x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.</p> <p>changedetection.io&#39;s REST API resources are protected by an @auth.check_token decorator validating the caller&#39;s x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.check_token nor @validate_openapi_request.</p> https://db.gcve.eu/vuln/fkie_cve-2026-71203 https://db.gcve.eu/vuln/ghsa-9vx6-gpfr-5qq7 <p>changedetection.io&#39;s REST API resources are protected by an @auth.check_token decorator validating the caller&#39;s x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get() method carries neither @auth.check_token nor @validate_openapi_request. An unauthenticated client can retrieve the full merged OpenAPI schema (all endpoint paths, parameters, and registered processor plugins) even when API access control is enabled and every sibling /api/v1/* route correctly requires the key.</p> <p>changedetection.io&#39;s REST API resources are protected by an @auth.check_token decorator validating the caller&#39;s x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get() method carries neither @auth.check_token nor @validate_openapi_request. An unauthenticated client can retrieve the full merged OpenAPI schema (all endpoint paths, parameters, and registered processor plugins) even when API access control is enabled and every sibling /api/v1/* route correctly requires the key.</p> https://db.gcve.eu/vuln/ghsa-9vx6-gpfr-5qq7