CVE-2026-95656 in changedetection.io
Summary
by MITRE • 09/22/2026
A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function add_watch_ui_snapshot of the file changedetectionio/blueprint/add_watch_ui/__init__.py of the component Preview Endpoint. Performing a manipulation of the argument url results in server-side request forgery. The attack can be initiated remotely. The exploit has been made public and could be used. Upgrading to version 0.60.1 is able to resolve this issue. The patch is named 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e. The affected component should be upgraded. Was fixed upstream.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in changedetection.io prior to commit 50389b07 represents a critical server-side request forgery flaw within the Preview Endpoint functionality. This security issue specifically resides in the add_watch_ui_snapshot function located in the file changedetectionio/blueprint/add_watch_ui/_init_.py. The core technical deficiency lies in how the application handles user-supplied input for the url argument without adequate validation or sanitization mechanisms. When an attacker provides a manipulated URL value, the server processes this input and initiates HTTP requests to the specified destination on behalf of the victim system. This behavior allows remote attackers to bypass internal network restrictions by leveraging the privileged access rights of the application server itself.
From a technical perspective, this vulnerability is classified under CWE-918, which defines Server-Side Request Forgery (SSRF). The flaw enables an attacker to force the affected web application to send requests to arbitrary destinations that may be located within internal networks or on local host environments where access would otherwise be restricted. By crafting specific malicious payloads for the url parameter, adversaries can probe internal services such as database interfaces, administrative panels, or cloud metadata endpoints like AWS EC2 instance metadata service. This capability significantly expands the attack surface beyond traditional external-facing vulnerabilities, allowing for potential data exfiltration from internal systems that are not directly exposed to the public internet.
The operational impact of this vulnerability is severe due to its remote exploitability and the availability of existing proof-of-concept exploits in the wild. Attackers can initiate these attacks without authentication if the affected endpoint is publicly accessible, although some configurations may require valid user credentials depending on deployment settings. Successful exploitation could lead to unauthorized access to internal resources, disclosure of sensitive configuration data, or further lateral movement within a network infrastructure. The presence of public exploit code increases the likelihood of automated scanning and targeted attacks against instances running vulnerable versions, making prompt remediation essential for maintaining system integrity.
In terms of threat intelligence alignment, this vulnerability maps directly to MITRE ATT&CK technique T1598, specifically Stealing Web Session Cookies or Phishing via SSRF if used in conjunction with other techniques, but primarily it aligns with the broader category of Server-Side Request Forgery which facilitates reconnaissance and data access. The lack of strict allow-listing for outbound requests from the preview endpoint is a common architectural weakness that violates secure coding principles regarding trust boundaries between user input and server-side processing logic.
To mitigate this risk, organizations must upgrade changedetection.io to version 0.60.1 or later, which incorporates the upstream fix identified by commit hash 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e. This patch implements stricter validation rules for URL inputs to prevent unauthorized outbound connections. Additionally, administrators should implement network-level controls such as firewall rules or reverse proxy configurations that restrict the application server from initiating requests to internal IP ranges unless explicitly required for business functions. Regular security audits and input validation checks on all endpoints handling user-supplied URLs are recommended practices to prevent similar SSRF vulnerabilities in future development cycles.