This vulnerability stems from a missing authentication check on the /api/v1/full-spec endpoint in changedetection.io’s REST API. The endpoint returns the complete merged OpenAPI schema—including all available endpoint paths, parameters, and registered processor plugins—without requiring a valid x‑api‑key header. Consequently, any client that can reach the API can retrieve the full specification, exposing sensitive structural details about the application. While the flaw does not immediately grant direct control over the system, the disclosed schema can aid attackers in identifying other exploitable endpoints, planning targeted attacks, and automating reconnaissance.

The issue affects all installations of changedetection.io that expose the /api/v1/full-spec route. No specific version numbers are provided in the advisory, so any current or prior release may be vulnerable if the endpoint remains unprotected. The vendor is dgtlmoon, and patches are tracked in the public GitHub repository.

The CVSS score of 5.3 indicates a moderate risk level. No EPSS score is available, so the current likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The attack vector appears to be network‑based: an unauthenticated HTTP(S) request sent to /api/v1/full-spec can trigger the disclosure, assuming the API is reachable and no additional network filtering is in place.