CVE-2026-92815

changedetection.io through version 0.60.6 contains a server-side request forgery flaw (CWE-918) because the Goto URL action in browser steps is not validated. An unauthenticated remote attacker can supply an arbitrary internal URL in the optional_value parameter of a browser step, causing the application's headless browser to fetch that location and return the response. This allows the attacker to read content from restricted network locations reachable by the server, such as cloud metadata endpoints or internal-only services, with high confidentiality impact and no integrity or availability impact per the CVSS 4.0 score of 8.7. Anyone running a self-hosted changedetection.io instance at version 0.60.6 or earlier is affected, especially instances reachable from untrusted networks. No public proof-of-concept or confirmed in-the-wild exploitation is known, and the issue is not listed in CISA KEV.

What to do: Upgrade to the latest changedetection.io release as soon as a patched build beyond 0.60.6 that validates the browser-step Goto URL action is available. In the interim, restrict access to the instance (require authentication via reverse proxy or firewall rules) and block browser-step egress to link-local and RFC1918 ranges, including 169.254.169.254. Check instance logs for requests carrying internal URLs in the optional_value parameter as an indicator of probing.