9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35490

CVE-2026-35490: changedetection.io has an Authentication Bypass via Decorator Ordering

changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, the @login_optionally_required decorator is placed before (outer to) @blueprint.route() instead of after it. In Flask, @route() must be the outermost decorator because it registers the function it receives. When the order is reversed, @route() registers the original undecorated function, and the auth wrapper is never in the call chain. This silently disables authentication on these routes. This vulnerability is fixed in 0.54.8.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-35490

CVE-2026-35490:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
changedetection.io	pip	<= 0.54.7	0.54.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an authentication bypass caused by incorrect decorator ordering in the Flask application. In several blueprints, the @login_optionally_required decorator was applied before the @blueprint.route() decorator. According to Flask's design, the @route() decorator must be the outermost one, as it registers the function it wraps as a request handler. When the order is reversed, @route() registers the original, undecorated function, effectively ignoring the authentication check provided by @login_optionally_required. This allowed unauthenticated access to sensitive endpoints. The analysis of the provided patch commit reveals several functions across different blueprints where this decorator order was corrected, thus fixing the vulnerability for those routes. The identified vulnerable functions were responsible for handling backups (creation, download, deletion), backup restoration, and browser-step operations, all of which could be triggered by an unauthenticated attacker.

Vulnerable functions

request_backup

changedetectionio/blueprint/backups/__init__.py

The `@login_optionally_required` decorator was incorrectly placed before the `@backups_blueprint.route` decorator. In Flask, the `@route` decorator must be the outermost to correctly register the wrapped function with all its decorators. Due to this incorrect ordering, the `request_backup` function was registered without the authentication check, allowing unauthenticated users to trigger a backup creation.

download_backup

changedetectionio/blueprint/backups/__init__.py

The incorrect ordering of the `@login_optionally_required` and `@backups_blueprint.route` decorators caused the authentication check for the `download_backup` function to be bypassed. This allowed an unauthenticated attacker to download sensitive backup files.

create

changedetectionio/blueprint/backups/__init__.py

The `create` function, responsible for rendering the backup creation page, was left unprotected due to the decorator ordering issue. This exposed two routes ('/' and '/create' under the backups blueprint) to unauthenticated access.

remove_backups

changedetectionio/blueprint/backups/__init__.py

Authentication was bypassed for the `remove_backups` function due to the incorrect decorator order. This allowed an unauthenticated attacker to delete all existing backups.

restore

changedetectionio/blueprint/backups/restore.py

The `restore` function, which displays the backup restoration page, was accessible to unauthenticated users because the `@login_optionally_required` decorator was not correctly applied.

backups_restore_start

changedetectionio/blueprint/backups/restore.py

The `backups_restore_start` function, which initiates the backup restore process, was vulnerable to unauthenticated access due to the incorrect decorator ordering, allowing an attacker to upload and restore a potentially malicious backup.

browsersteps_start_session

changedetectionio/blueprint/browser_steps/__init__.py

The `browsersteps_start_session` function was unprotected due to the decorator ordering flaw, enabling an unauthenticated user to start a new browser steps session, potentially leading to resource exhaustion or other issues.

browser_steps_fetch_screenshot_image

changedetectionio/blueprint/browser_steps/__init__.py

Authentication was bypassed for the `browser_steps_fetch_screenshot_image` function, allowing an unauthenticated user to fetch screenshot images related to browser automation steps, potentially leaking sensitive information.

browsersteps_ui_update

changedetectionio/blueprint/browser_steps/__init__.py

The `browsersteps_ui_update` function was left unprotected due to the decorator ordering issue, allowing unauthenticated POST requests. This could lead to unauthorized modifications of browser step configurations.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.