CVE-2026-35490

CVE-2026-35490 is an authentication bypass vulnerability affecting changedetection.io, a free open-source web page change detection tool, in versions prior to 0.54.8. The vulnerability exists due to incorrect decorator ordering in the Flask application, where the @login_optionally_required decorator is placed outside the @blueprint.route() decorator instead of inside it. This misconfiguration causes Flask to register the undecorated function, completely bypassing authentication checks on affected routes and allowing unauthorized access. The vulnerability carries a CVSS 3.1 score of 9.8 (CRITICAL) with a network-based attack vector requiring no privileges or user interaction, making it trivially exploitable from the internet. The impact is severe, with confirmed high severity ratings for confidentiality, integrity, and availability, meaning successful exploitation could lead to complete system compromise including unauthorized data access, modification, and service disruption. There is currently no evidence of active exploitation in the wild, as the vulnerability does not appear on CISA's Known Exploited Vulnerabilities list and has an extremely low exploit prediction score. However, the straightforward nature of the vulnerability and the availability of the affected open-source code means that proof-of-concept exploits could be developed easily. Organizations running changedetection.io versions prior to 0.54.8 should prioritize immediate patching to restore authentication security.