Technical impact
This vulnerability stems from a missing authentication check on the /api/v1/full-spec endpoint in changedetection.io’s REST API. The endpoint returns the complete merged OpenAPI schema—including all available endpoint paths, parameters, and registered processor plugins—without requiring a valid x‑api‑key header, because the Spec resource does not apply the @auth.check_token or @validate_openapi_request decorators. Consequently, any client that can reach the API can retrieve the full specification, exposing sensitive structural details about the application. While the flaw does not immediately grant direct control over the system, the disclosed schema can aid attackers in identifying other exploitable endpoints, planning targeted attacks, and automating reconnaissance.
Affected Systems
The issue affects all installations of changedetection.io that expose the /api/v1/full-spec route. No specific version numbers are provided in the advisory, so any current or prior release may be vulnerable if the endpoint remains unprotected. The vendor is dgtlmoon, and patches are tracked in the public GitHub repository.
Risk and Exploitability
The EPSS score of <1% indicates a very low probability of exploitation, though not zero, while the CVSS score of 5.3 indicates a moderate risk level. The vulnerability is not listed in the CISA KEV catalog. The attack vector appears to be network‑based: an unauthenticated HTTP(S) request to /api/v1/full-spec can trigger disclosure, assuming the API is reachable and no additional network filtering is in place.
