CVE-2024-23329Low· 3.7▾ Sunlitchangedetection.io API endpoint is not secured with API token
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.6%
API endpoint /api/v1/watch/<uuid>/history can be accessed by any unauthorized user.
WatchHistory resource does not have @auth.check_token annotation, which means it can be accessed without providing x-api-key header.
x-api-key:$ curl -H "x-api-key: apikeyhere" http://localhost:5000/api/v1/watch
{"uuid": ...}
x-api-key. Expected - 401/403 error. Actual - list of snapshots is listed.$ curl http://localhost:5000/api/v1/watch/uuid/history
{"timestamp": "/path/to/snapshot.txt"}
Anybody can check one's watch history. However, because unauthorized party first needs to know watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal.
changedetection-io >= 0.39.14, < 0.45.13Upgrade to a patched release:
changedetection-io 0.45.13Connected by shared product, vendor, weakness, or advisory.
CVE-2024-32651Critical· 10.0changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution
CVE-2026-27645Medium· 6.1changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
CVE-2026-29038Medium· 6.1changedetection.io has Reflected XSS in its RSS Tag Error Response
CVE-2026-29039Highchangedetection.io vulnerable to XPath - Arbitrary File Read via unparsed-text()
CVE-2026-33981HighChangedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
CVE-2026-27696High· 8.6changedetection.io is Vulnerable to SSRF via Watch URLs