What is CVE-2026-71204?

CVE-2026-71204 is a medium-severity vulnerability in Dgtlmoon Changedetection.io, classified under Improper Access Control. CVSS score: 6.2/10. Published 2026-08-05.

How severe is CVE-2026-71204?

Medium severity. CVSS v3 base score is 6.2 out of 10.

Is CVE-2026-71204 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Dgtlmoon Changedetection.io

CVE-2026-71204

changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.

EPSS: 0.003 (17.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.2 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L.

Affected products

Dgtlmoon Changedetection.io — versions 0.55.7

Weakness classification (CWE)

CWE-284 — Improper Access Control

Public proof-of-concept exploits

Nel-droid/CVE-2026-71204-PoC

References

309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c (third-party-advisory)

Frequently asked questions

What is CVE-2026-71204?: CVE-2026-71204 is a medium-severity vulnerability in Dgtlmoon Changedetection.io, classified under Improper Access Control. CVSS score: 6.2/10. Published 2026-08-05.
How severe is CVE-2026-71204?: Medium severity. CVSS v3 base score is 6.2 out of 10.
Is CVE-2026-71204 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.