VYPR
← All advisories
Low severityNVD Advisory· Published Jan 19, 2024· Updated Nov 13, 2024

changedetection.io API endpoint is not secured with API token

CVE-2024-23329

Description

changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint /api/v1/watch/<uuid>/history can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal. This issue has been addressed in version 0.45.13. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
changedetection.ioPyPI
>= 0.39.14, < 0.45.130.45.13

Affected products

1

Patches

1
402f1e47e78e

Security update - Adding API token secure check for API endpoint `/api/v1/watch/<uuid>/history` @rozpuszczalny

https://github.com/dgtlmoon/changedetection.iodgtlmoonJan 18, 2024via ghsa
commit
1 file changed · +1 −0
  • changedetectionio/api/api_v1.py+1 −0 modified
    @@ -133,6 +133,7 @@ def __init__(self, **kwargs):
 
     # Get a list of available history for a watch by UUID
     # curl http://localhost:5000/api/v1/watch/<string:uuid>/history
+    @auth.check_token
     def get(self, uuid):
         """
         @api {get} /api/v1/watch/<string:uuid>/history Get a list of all historical snapshots available for a watch

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.