CVE-2026-35490 — changedetection.io has an Authentication Bypass via Decorator Ordering

Affected: dgtlmoon changedetection.io

changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, the @login_optionally_required decorator is placed before (outer to) @blueprint.route() instead of after it. In Flask, @route() must be the outermost decorator because it registers the function it receives. When the order is reversed, @route() registers the original undecorated function, and the auth wrapper is never in the call chain. This silently disables authentication on these routes. This vulnerability is fixed in 0.54.8.

GHSA-jmrh-xmgh-x9j4 — changedetection.io Vulnerable to Authentication Bypass via Decorator Ordering

Affected: PyPI: changedetection.io

### Summary

On 13 routes across 5 blueprint files, the `@login_optionally_required` decorator is placed **before** (outer to) `@blueprint.route()` instead of after it. In Flask, `@route()` must be the outermost decorator because it registers the function it receives. When the order is reversed, `@route()` registers the **original undecorated function**, and the auth wrapper is never in the call chain. This silently disables authentication on these routes.

The developer correctly uses the decorator on 30+ other routes with the proper order, making this a classic consistency gap.

### Details

**Correct order (used on 30+ routes):** ```python @blueprint.route('/settings', methods=['GET']) @login_optionally_required def settings(): ... ```

**Incorrect order (13 vulnerable routes):** ```python @login_optionally_required # ← Applied to return value of @route, NOT the view @blueprint.route('/backups/download/<filename>') # ← Registers raw function def download_backup(filename): ... ```

## POC ``` === PHASE 1: Confirm Authentication is Required ===

$ curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:5557/ Main page: HTTP 302 -> http://127.0.0.1:5557/login?next=/ $ curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:5557/settings Settings page: HTTP 302 (auth required, redirects to login)

Password is set. Unauthenticated requests to / and /settings are properly redirected to /login.

=== PHASE 2: Authentication Bypass on Backup Routes === (All r…

Most recent entries from all

CVE-2026-35490 — changedetection.io has an Authentication Bypass via Decorator Ordering

GHSA-jmrh-xmgh-x9j4 — changedetection.io Vulnerable to Authentication Bypass via Decorator Ordering