Threats Tagged 'cve-2026-71204'
View all threats tagged with 'cve-2026-71204'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-71204'
Click on any threat for detailed analysis and mitigation recommendations
CVE-2026-71204: CWE-284 Improper Access Control in dgtlmoon changedetection.ioCVE-2026-71204 0 changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update(). Because WTForms represents an unchecked checkbox as False rather than 'unchanged', and only the 'password' field is special-cased against this problem, a POST to /settings that omits the api_access_token_enabled field (e.g. a minimal scripted request) silently disables API key enforcement for the entire REST API, exposing the full watch list, history, and configuration to unauthenticated requests. Join the discussion | CVE Database V5 | 08/05/2026, 06:59:00 UTC Added: 08/05/2026, 07:27:07 UTC |
Showing 1 to 1 of 1 result