CVE-2026-92815 — changedetection.io through 0.60.6 SSRF via browser-step Goto URL
changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply a…
Published: 2026-09-16 · CVSS: 8.7 · CVSS 4.0
changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optional_value parameter to retrieve responses from restricted network locations.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7