changedetection.io's REST API generally protects resources using an @auth.check_token decorator that validates the caller's x-api-key header. However, the Spec resource registered at /api/v1/full-spec (in changedetectionio/api/Spec.py) lacks this authentication check and also does not use @validate_openapi_request. This results in a missing authentication vulnerability (CWE-306), allowing unauthenticated users to access potentially sensitive API functionality. The vulnerability affects version 0.55.7 of changedetection.io. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

An attacker can access the /api/v1/full-spec endpoint without authentication, potentially exposing sensitive information or API functionality that should be restricted. The CVSS score of 5.3 reflects a medium impact with low complexity and no required privileges or user interaction. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected endpoint via network controls or API gateway rules to enforce authentication. Monitor vendor channels for updates.