changedetection.io’s /settings save handler builds an update dictionary from the posted form data and blindly merges that dictionary into the current application settings. Because the merge replaces any missing keys with the form value, an omitted checkbox field is interpreted as a value of False and overwrites the existing setting. The title indicates that the omitted field controls API key enforcement, so when it is unchecked and omitted, the setting is set to False, thereby disabling the requirement for an API key on every REST‑API request. This flaw exposes all watch lists, history, and configuration data to unauthenticated callers. The vulnerability is classified as CWE‑284 (Incorrect Authorization).

Installed instances of changedetection.io provided by dgtlmoon are affected. No specific version numbers were supplied, indicating that all current releases may contain the flaw until a patch is released.

The CVSS score of 6.3 indicates a medium‑severity condition. The EPSS score of less than 1 % suggests that exploitation is currently unlikely, and the bug is not yet listed in the CISA KEV catalogue. Likely attackers would use a crafted HTTP POST to the /settings endpoint, omitting the API key enforcement checkbox. Because the endpoint is normally accessed through the web user interface, an attacker would first need to be authenticated to the web UI or otherwise spoof a session cookie. Once the setting is changed, every subsequent REST‑API call can be made without an authorization token, giving full read access to the system’s data. The risk, therefore, hinges on the potential for an authenticated compromise of the web UI, and the impact would be an extended window of unauthenticated exposure of sensitive data.