CVE-2026-92815: changedetection.io through 0.60.6 SSRF via browser-step Goto URL
changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optionalvalue parameter to retrieve responses from restricted network locations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
changedetection.ioto a version that resolves this vulnerability.Fixed in 0.60.6
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it over the network. Exploitation does not require user interaction or prior privileges.
What access does the attacker gain through exploitation?
The attacker can provide arbitrary internal URLs in the browser-step Goto action's optional_value parameter and retrieve responses from restricted network locations. The issue affects confidentiality; no integrity or availability impact is indicated by the supplied severity vector.
Which configurations are affected?
Instances using browser steps with the Goto URL action are exposed because the Goto URL is not validated. The supplied information does not state whether browser steps or this action are enabled by default.
How can I determine whether my instance is affected?
Versions through 0.60.6 are affected. Review browser-step definitions for Goto actions and check whether their optional_value fields can be supplied or modified by untrusted users.