CVE-2026-35490 - Vulnerability Analysis

Overview

changedetection.io < 0.54.8 contains a broken authentication caused by incorrect decorator order in Flask routes, letting attackers bypass authentication on affected routes, exploit requires access to affected routes.

Severity & Score

Impact

Attackers can bypass authentication, gaining unauthorized access to protected routes and data.

Mitigation

Update to version 0.54.8 or later.

References

• https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-jmrh-xmgh-x9j4

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner