An omission in changedetection.io’s /settings save handler causes a blind update of application settings when a checkbox field is left unchecked. The form processing treats an unchecked checkbox as a False value instead of leaving the setting unchanged, and only the password field is exempt from this behavior. The result is that a POST request to /settings that omits the api_access_token_enabled field will unintentionally set that value to False, disabling API key enforcement for the entire REST API. As a consequence, the full watch list, history, and configuration become reachable without authentication, exposing sensitive data to unauthenticated users. This flaw falls under CWE‑284, Incorrect Authorization._\n\nThe vulnerability is leveraged by sending a crafted HTTP POST to the /settings endpoint, omitting the relevant checkbox field, which the application interprets as a directive to disable API key enforcement. Because the endpoint requires user authentication, attackers must first obtain a session or otherwise authenticate to the web interface; however, the impact is significant once the setting is altered, as every subsequent REST API call becomes unauthenticated.\n\nOverall, the flaw grants attackers full visibility into the system’s monitoring configuration and any stored data, thereby posing a moderate risk to confidentiality and potentially to integrity if the attacker subsequently alters resources through the now-unprotected API._

Affected systems are installations of changedetection.io maintained by dgtlmoon. No specific version information was provided, suggesting that all currently released versions may contain the vulnerability until an official fix is released.

The CVSS score of 6.3 indicates a medium severity attack. The EPSS score is not available, so the precise likelihood of exploitation cannot be quantified, but the lack of KEV listing suggests there are no known public exploits yet. The attack vector requires an authenticated session to the web interface, yet the impact is far-reaching once the setting is altered. Because the flaw silently changes a critical security parameter, it is easy for an attacker to trigger without detection, making the exploitation risk relatively high if the vulnerability remains unpatched. The most likely vector is a malicious user with access to the web UI or an attacker who can spoof authentication cookies to submit the malformed POST request.