CVE-2026-35490 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-35490 requires immediate attention.

· 3 min read

```html

Executive Summary

A critical vulnerability (CVE-2026-35490) has been identified in pip changedetection.io affecting the authentication mechanism on 13 routes. The flaw arises from the incorrect order of decorators in the Flask framework, leading to an authentication bypass. This vulnerability could allow unauthorized users to access sensitive backup data, including API tokens and configurations, posing significant security risks.

Immediate Action

  • Review your codebase for the use of the @login_optionally_required decorator on backup-related routes.
  • Swap the order of the decorators on all affected routes as detailed in the Resolution Guide.
  • Monitor application access logs for any unauthorized access attempts.
  • Consider isolating the affected service until the patch is applied.
  • Stay updated with any vendor advisories for further guidance.

Affected Versions

  • changedetection.io@<=X.Y.Z vulnerable; upgrade to X.Y.Z+ (exact fixed version TBD)

Resolution Guide

To remediate the vulnerability, follow these steps:

# Example of fixing the decorator order in your Flask app
# Before (VULNERABLE):
@login_optionally_required
@blueprint.route('/backups/download/')
def download_backup(filename):
    ...

# After (FIXED):
@blueprint.route('/backups/download/')
@login_optionally_required
def download_backup(filename):
    ...

For package management, use the following commands to update:

# Python (pip)
pip install changedetection.io==X.Y.Z+  # Replace with the latest secure version

Detection & Verification

To check if your application is vulnerable:

# Check for vulnerable decorator usage
grep -r '@login_optionally_required' /path/to/your/project/

To verify the fix:

# Test backup routes without authentication
curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:5557/backups/
# Expected output: HTTP 302 (should redirect to login)

Risk and Impact

This vulnerability allows attackers to bypass authentication on critical backup routes, leading to complete data exfiltration, including sensitive configurations and API tokens. The potential for data manipulation and unauthorized access to internal systems significantly increases the risk of compromise.

```

Keep reading