In changedetection.io version 0.55.7, the /settings save handler builds an update dictionary from form data and merges it into stored application settings. WTForms represents unchecked checkboxes as False rather than 'unchanged', but only the 'password' field is specially handled. As a result, a POST request to /settings that omits the api_access_token_enabled field silently disables API key enforcement for the REST API. This exposes the full watch list, history, and configuration to unauthenticated requests, constituting an improper access control vulnerability (CWE-284).

An attacker with the ability to send a crafted POST request to /settings can disable API key enforcement, gaining unauthenticated access to sensitive user data including watch lists, history, and configuration. This leads to confidentiality and integrity impacts, with limited availability impact. The CVSS 3.1 base score is 6.3 (medium severity), reflecting network attack vector, high complexity, high privileges required, no user interaction, and high confidentiality and integrity impact.

No official patch or remediation is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the /settings endpoint to trusted users only and monitor for suspicious POST requests that might omit the api_access_token_enabled field. Avoid using version 0.55.7 in exposed environments or apply custom controls to enforce API key usage.