---
id: CVE-2024-23329
aliases:
  - GHSA-hcvp-2cc7-jrwr
  - PYSEC-2024-15
title: changedetection.io API endpoint is not secured with API token
summary: changedetection.io API endpoint is not secured with API token
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
vendor: changedetection-io
product: changedetection-io
ecosystem: pip
affected:
  - 'changedetection-io >= 0.39.14, < 0.45.13'
patched:
  - changedetection-io 0.45.13
published: '2024-01-23'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:00.333924967Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-hcvp-2cc7-jrwr'
references:
  - url: >-
      https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-hcvp-2cc7-jrwr
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-23329'
  - url: >-
      https://github.com/dgtlmoon/changedetection.io/commit/402f1e47e78ecd155b1e90f30cce424ff7763e0f
  - url: 'https://github.com/dgtlmoon/changedetection.io'
  - url: >-
      https://github.com/dgtlmoon/changedetection.io/blob/9510345e01ea8e308c339163d8e8b030ce5ac7f1/changedetectionio/api/api_v1.py#L129-L156
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/changedetection-io/PYSEC-2024-15.yaml
tags:
  - osv
  - pip
epss: 0.00587
epssPercentile: 0.46799
ingestedAt: '2026-09-12T03:13:01.699Z'
---

## Overview

### Summary

API endpoint `/api/v1/watch/<uuid>/history` can be accessed by any unauthorized user.

### Details

WatchHistory resource does not have `@auth.check_token` annotation, which means it can be accessed without providing `x-api-key` header.

https://github.com/dgtlmoon/changedetection.io/blob/9510345e01ea8e308c339163d8e8b030ce5ac7f1/changedetectionio/api/api_v1.py#L129-L156

### PoC

1. Get list of watch with `x-api-key`:
```sh
$ curl -H "x-api-key: apikeyhere" http://localhost:5000/api/v1/watch
{"uuid": ...}
```
2. Call for history of snapshots without `x-api-key`. Expected - 401/403 error. Actual - list of snapshots is listed.
```sh
$ curl http://localhost:5000/api/v1/watch/uuid/history
{"timestamp": "/path/to/snapshot.txt"}
```

### Impact

Anybody can check one's watch history. However, because unauthorized party first needs to know watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal.


## Affected packages

- `changedetection-io >= 0.39.14, < 0.45.13`

## Remediation

Upgrade to a patched release:

- `changedetection-io 0.45.13`