CVE-2026-92815 in changedetection.io
Summary
by MITRE • 09/16/2026
changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optional_value parameter to retrieve responses from restricted network locations.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in changedetection.io versions up through 0.60.6 represents a critical security flaw rooted in insufficient input validation within the application's browser automation workflow. Specifically, the Goto URL action executed during browser steps fails to properly sanitize or validate the target destination provided by the user. This lack of rigorous verification allows an unauthenticated attacker to manipulate the optional_value parameter associated with this action. By injecting arbitrary internal URLs into this field, the attacker can redirect the application's headless browser instance to access resources that are intended to be restricted from external or public-facing networks.
From a technical perspective, this flaw constitutes a classic Server-Side Request Forgery (SSRF) vulnerability. The core issue lies in the server-side processing of user-supplied data where the system trusts the input without verifying whether the destination address falls within an allowed whitelist or is blocked by internal network policies. When the application processes the Goto URL command, it constructs a request to the specified IP or hostname and executes it using its own network privileges. Because this execution occurs on the server side rather than in the client's browser, the resulting traffic originates from the vulnerable host itself. This allows the attacker to bypass perimeter security controls such as firewalls that would normally block direct external access to internal services like database management interfaces, administrative panels, or cloud metadata endpoints.
The operational impact of this vulnerability is severe due to its unauthenticated nature and potential for data exfiltration or network reconnaissance. An attacker can probe the internal network topology by attempting requests to common internal IP ranges, such as 127.0.0.1 for local services, 169.254.169.254 for cloud provider metadata, or private subnet addresses like 10.x.x.x and 192.168.x.x. Successful exploitation can lead to the retrieval of sensitive configuration files, authentication tokens stored in environment variables via cloud metadata services, or direct interaction with internal APIs that lack additional access controls. In environments where changedetection.io is deployed within a corporate network, this vulnerability effectively bridges the gap between the public internet and the protected internal infrastructure, potentially leading to full system compromise if combined with other vulnerabilities in backend services.
This flaw aligns directly with CWE-918, which describes Server-Side Request Forgery (SSRF) flaws where web applications fetch remote resources without validating user-supplied URLs. Furthermore, from a tactical perspective as defined by the MITRE ATT&CK framework, this vulnerability facilitates the Reconnaissance and Collection techniques under Tactic TA0043. Specifically, it enables internal network discovery through active scanning of private IP ranges (T1592) and potentially credential access via cloud metadata retrieval if deployed in compatible environments. The ability to make requests from a trusted source allows attackers to bypass identity-based authentication mechanisms that rely on source IP verification.
To mitigate this vulnerability, immediate patching to version 0.60.7 or later is required as the developers have addressed the input validation logic for browser step actions. In addition to upgrading, organizations should implement network-level controls such as egress filtering rules that restrict outbound connections from the changedetection.io host to only known and necessary external domains. Internal services accessed by the application should be configured with strict access control lists (ACLs) or firewall rules that prevent direct HTTP/HTTPS access from untrusted sources. Deploying a reverse proxy in front of internal services can also help enforce authentication requirements before any request reaches sensitive backend systems, adding an additional layer of defense against SSRF exploitation attempts.