The vulnerability in changedetection.io (CVE-2026-71204) involves improper access control (CWE-284) in the /settings save handler. The handler constructs an update dictionary from form.data['application'] and merges it directly into the stored application settings using the .update method without validating the input. This blind merge allows users with certain privileges to modify application settings in an unauthorized manner. The CVSS 3.1 score is 6.3 (medium severity), reflecting network attack vector, high attack complexity, required privileges, no user interaction, and high impact on confidentiality and integrity with low impact on availability. The affected version is exactly 0.55.7. No patch or official remediation has been indicated yet.

Successful exploitation could allow an attacker with the required privileges to modify application settings improperly, potentially leading to unauthorized changes that affect confidentiality and integrity of the application. Availability impact is low. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /settings functionality to trusted users only and monitor for suspicious configuration changes.