CVE-2026-92815

changedetection.io through 0.60.6 is vulnerable to an unauthenticated SSRF via the browser-step Goto URL action. The root cause is that the SSRF guard is only applied to the main watch URL and is bypassed in browser step Goto URLs, allowing attackers to supply arbitrary internal URLs in the optio...

EUVD-2026-81073

changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optionalvalue parameter to retrieve responses from restricted network locations...

CVE-2026-92815 changedetection.io through 0.60.6 SSRF via browser-step Goto URL

changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optionalvalue parameter to retrieve responses from restricted network locations...