The flaw arises from incorrect ordering of Flask decorators, causing the authentication wrapper to be omitted from the route handlers. As a result, any request to protected endpoints is served without validating credentials, giving attackers unrestricted access. This vulnerability aligns with CWE-863, representing authentication bypass issues.

The affected product is changedetection.io from dgtlmoon, versions prior to 0.54.8. Users running these earlier releases are susceptible if the web interface exposes routes that should require login.

With a CVSS score of 9.8, the vulnerability is considered critical. The EPSS score is unavailable but the lack of a KEV listing does not mitigate the high potential for exploitation. An attacker can exploit this remotely by sending unauthenticated HTTP requests to the affected endpoints, gaining full control over the application's functionality without needing valid credentials.