CVE-2026-71204: medium-severity vulnerability in dgtlmoon changedetection.io
changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.3epss 0.3%
from disclosure to weapon11 days
Published on NVDAug 5
1st PoC+11d
changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
Affected products
dgtlmoon · changedetection.iopublic PoCs found — 1
githubgithub.com/Nel-droid/CVE-2026-71204-PoC★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — dgtlmoon changedetection.io
In the same product, most dangerous first.
CVE-2024-32651CRITICALServer Side Template Injection in Jinja2 allows Remote Command ExecutionEPSS 85.3%CVE-2024-51483MEDIUMchangedetection.io Path Traversal vulnerabilityEPSS 2.3%CVE-2024-34061MEDIUMReflected cross site scripting in changedetection.ioEPSS 1.3%CVE-2026-25527MEDIUMchangedetection.io vulnerable to unauthenticated static path traversalEPSS 1.0%CVE-2024-56509HIGHchangedetection.io has Improper Input Validation Leading to LFR/Path TraversalEPSS 0.7%CVE-2024-51998HIGHPath traversal using file URI scheme without supplying hostname in changedetection.ioEPSS 0.7%