CVE-2024-23329 changedetection.io API endpoint is not secured with API token
Unauthenticated users can access watch history via API if UUID is known, exposing minimal privacy data in changedetection.io.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-23329?
CVE-2024-23329 is a low-severity missing authorization vulnerability in dgtlmoon changedetection.io, published on 19 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint `/api/v1/watch/<uuid>/history` can be accessed by any unauthorized user. As a result any unauthorized user can check one's watch history. However, because unauthorized party first needs to know a watch UUID, and the watch history endpoint itself returns only paths to the snapshot on the server, an impact on users' data privacy is minimal. This issue has been addressed in version 0.45.13. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-863
Which versions are affected by CVE-2024-23329?
3 open source packages ship an affected version, including changedetection.io and changedetection-io. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
changedetection.io PyPI | From 0.39.14 | 0.45.13 |
changedetection-io PyPI | From 0.39.14 | 0.45.13 |
changedetection-io PyPI | From 0.39.14 | 0.45.13 |
Products include Webtechnologies Changedetection.
How do I fix CVE-2024-23329?
Upgrade changedetection.io to 0.45.13 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-23329 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-23329 exists.
Other vulnerabilities in dgtlmoon changedetection.io
- CVE-2026-35490 changedetection.io has an Authentication Bypass via Decorator Ordering
- CVE-2026-29039 changedetection.io: XPath - Arbitrary File Read via unparsed-text()
- CVE-2026-29065 changedetection.io: Zip Slip vulnerability in the backup restore functionality
- CVE-2026-27696 changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs
- CVE-2026-33981 Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
Sources
Also known as GHSA-hcvp-2cc7-jrwr, PYSEC-2024-15.