CVE-2026-35490: changedetection.io is a free open source web page change detection tool

This week

CRITICAL 9.8REMOTEUPGRADE

CVE-2026-35490 is a critical-severity flaw (CVSS 9.8) affecting changedetection. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, the @login_optionally_required decorator is placed before (outer to) @blueprint.route() instead of after it. In Flask, @route() must be the outermost decorator because it registers the function it receives. When the order is reversed, @route() registers the original undecorated function, and the auth wrapper is never in the call chain. This silently disables

Why this priority

Critical severity
Public exploit reference
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.5% (top 55%)
CISA exploited list	No
Weakness	CWE-863
Published	2026-04-07
Last modified	2026-10-26

Publisher (CNA): GitHub, Inc. · Vendor: webtechnologies

Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-04-07 16:16 UTCPublished CVE record published
2026-10-26 21:10 UTCUpdated Record last modified

webtechnologies changedetection UPGRADE

Affected: < 0.54.8

Fixed in: 0.54.8

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy changedetection || rpm -q changedetection || changedetection --version

2. UPGRADE to 0.54.8 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade changedetection

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade changedetection

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

Python (pip) · changedetection.io · FIXED · 0.54.8 · vulnerable: <= 0.54.7 · source

pip install --upgrade "changedetection.io>=0.54.8" pip show changedetection.io

Fedora ELN · rust-snpguest · FIXED · 0.11.0-1.eln159 · FEDORA-2026-baa01ba6c8 · source

sudo dnf upgrade --advisory=FEDORA-2026-baa01ba6c8

Fedora 46 · rust-sev · FIXED · 8.0.0-1.fc46 · FEDORA-2026-df06b5fb0c · source

sudo dnf upgrade --advisory=FEDORA-2026-df06b5fb0c

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Write-up: github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-jmrh-xmgh-x9j4

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-35490?

changedetection: upgrade to 0.54.8. Exact commands for each OS are on this page.

Is CVE-2026-35490 being exploited?

CVE-2026-35490 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-35490 affect?

CVE-2026-35490 affects changedetection. Severity is critical (CVSS 9.8). changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, the @login_optionally_required decorator is placed before (outer to) @blueprint.route() instead of after it. In Flask, @route() must be the outermost

How urgent is CVE-2026-35490?

Priority 59/100. Critical severity; Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Software pages

Flask vulnerabilities

Related CVEs

CVE-2026-33981 MEDIUM 6.5 UPGRADE changedetection.io is a free open source web page change detection tool
CVE-2026-43891 HIGH 7.5 UPGRADE changedetection.io is a free open source web page change detection tool
CVE-2026-41895 HIGH 7.5 UPGRADE changedetection.io is a free open source web page change detection tool
CVE-2026-35000 MEDIUM 6.5 UPGRADE ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPath3Parser

References

← Back to latest CVEs