changedetection.io EUVD-2026-84576

Requires a reachable changedetection.io instance exposing the Add Watch UI Preview endpoint (/snapshot in the add_watch_ui blueprint). The endpoint is protected only by login_optionally_required, so it is unauthenticated on default installs where no password is set, and authenticated where an operator has configured one. The url argument is validated only to start with http:// or https:// - no blocklist for loopback, RFC1918, link-local (169.254.169.254 cloud metadata), or DNS-rebinding targets - so any such URL is fetched server-side via the configured browser fetcher. Limiting factors: the instance must be network-reachable by the attacker, a working Playwright/sockpuppet fetcher backend must be running (else 502), and impact is bounded to what the returned screenshot/rendered data reveals about internal targets.

This is a moderate, credible risk rather than a critical one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with E:P describes a remotely reachable, low-complexity SSRF requiring no user interaction and - per the vendor vector - no privileges, with impacts capped at VC:L/VI:L/VA:L and no scope change (SC/SI/SA:N). The source code corroborates the vector: the /snapshot endpoint is guarded only by login_optionally_required, so on default changedetection.io deployments (which ship without a password until one is configured) the endpoint is effectively unauthenticated, supporting PR:N; where auth IS set, exploitation drops to authenticated. POC/exploit code is publicly available (GitHub herantong/cve and VulDB CTI), and E:P (Proof-of-Concept) in the vector matches that, but this is exploit availability, NOT active exploitation - there is no CISA KEV listing and no EPSS score supplied, so treat exploit maturity as 'public code exists, no confirmed in-the-wild use.' The URL scheme check only enforces http/https and does not block internal/loopback/link-local/cloud-metadata targets, which is the crux of the SSRF. Net: prioritize patching for any internet-exposed or multi-tenant instance, but the limited L/L/L impact and reliance on the instance being reachable keep this below the top tier.

An attacker reaches an exposed changedetection.io instance and issues a GET to the Add-Watch preview endpoint (/snapshot?url=...) supplying an internal target such as http://169.254.169.254/ or an internal service address. The server-side browser fetcher connects to that target and returns a screenshot/rendered data, letting the attacker probe internal hosts, cloud metadata, or intranet services from the server's network position. Public exploit code for this SSRF exists, lowering the barrier to weaponization.