EUVD-2026-81073
GHSA-4jg2-g9g4-7fpp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network SSRF against default no-auth deployments returns internal response content (C:H); no integrity or availability impact, and scope kept unchanged per vendor.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optional_value parameter to retrieve responses from restricted network locations.
AnalysisAI
Unauthenticated attackers can coerce changedetection.io through 0.60.6 into fetching arbitrary internal network addresses by abusing the 'Goto URL' action inside a browser step, because the application's SSRF guard is applied only to the main watch URL and never to the browser-step optional_value parameter. Successful exploitation returns the raw response from otherwise unreachable internal services, giving high-confidentiality read access with no write or code-execution impact (independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, high confidentiality only, scope unchanged, versus the vendor-scale 8.7 CVSS 4.0 score). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires reachability to the changedetection.io web interface and use of the browser-steps feature, which itself requires a configured Playwright/Chrome (browser) backend rather than the plain requests fetcher. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, actionable SSRF (CWE-918) with strong exploitability signals that align across sources. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or fixed version is identified in the available data; the only upstream code reference supplied points at the vulnerable 0.60.6 tag, so treat this as unpatched and verify against the project repository (https://github.com/dgtlmoon/changedetection.io) and the VulnCheck advisory (https://www.vulncheck.com/advisories/changedetection-io-through-0.60.6-ssrf-via-browser-step-goto-url) for a newer release before relying on one. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
No vendor-released patch identified at time of analysis. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Changedetection Io
View allArbitrary local file disclosure in ChangeDetection.io versions before 0.54.7 allows authenticated attackers to read sens
Unrestricted brute-force against changedetection.io's /login endpoint allows a remote unauthenticated attacker to system
HTML markup injection in changedetection.io through 0.60.6 allows an attacker who controls the <title> of a page being m
Authentication bypass in changedetection.io's /settings endpoint silently disables REST API key enforcement when a privi
Unauthenticated retrieval of the full OpenAPI schema is possible in changedetection.io because the /api/v1/full-spec end
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today