CVE-2026-35490 changedetection.io has an Authentication Bypass via Decorator Ordering
Attackers can bypass authentication on specific routes due to incorrect decorator ordering in changedetection.io, allowing unauthorized access to protected features.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35490?
CVE-2026-35490 is a critical authentication bypass vulnerability in dgtlmoon changedetection.io, published on 7 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, the @login_optionally_required decorator is placed before (outer to) @blueprint.route() instead of after it. In Flask, @route() must be the outermost decorator because it registers the function it receives. When the order is reversed, @route() registers the original undecorated function, and the auth wrapper is never in the call chain. This silently disables authentication on these routes. This vulnerability is fixed in 0.54.8.
Weakness: CWE-863
Which versions are affected by CVE-2026-35490?
3 open source packages ship an affected version, including changedetection.io and changedetection-io. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
changedetection.io PyPI | All versions | 0.54.8 |
changedetection-io PyPI | All versions | 0.54.8 |
changedetection-io PyPI | All versions | 0.54.8 |
Products include Webtechnologies Changedetection.
How do I fix CVE-2026-35490?
Upgrade changedetection.io to 0.54.8 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-35490 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35490 exists.
Other vulnerabilities in dgtlmoon changedetection.io
- CVE-2026-29039 changedetection.io: XPath - Arbitrary File Read via unparsed-text()
- CVE-2026-29065 changedetection.io: Zip Slip vulnerability in the backup restore functionality
- CVE-2026-27696 changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs
- CVE-2026-33981 Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
- CVE-2026-41895 changedetection.io: XXE vulnerability in the changedetection.io project
Sources
Also known as GHSA-jmrh-xmgh-x9j4, PYSEC-2026-28.