Executive brief
changedetection.io is a website monitoring tool that tracks changes to web pages and sends alerts. The application fails to properly validate URLs in its browser automation feature, allowing attackers to make it fetch internal or restricted addresses and retrieve responses from the company network without authentication. This could expose sensitive internal services, credentials, or data that should only be accessible within the organization.
Technical details
The vulnerability is an insufficient URL validation flaw in the Goto URL action within browser steps. Unauthenticated attackers can supply arbitrary internal URLs via the optional_value parameter, bypassing origin/destination validation. The application uses these URLs in browser automation workflows without proper checks, allowing Server-Side Request Forgery (SSRF)-like attacks to reach internal network locations, restricted IP ranges (including 127.0.0.1 and private subnets), and retrieve HTTP responses. No authentication is required; an attacker with access to the changedetection.io web interface can craft malicious browser steps. Patches are available in versions after 0.60.6.
Affected products
- dgtlmoon changedetection.io through 0.60.6
Timeline
- 2026-09-16: disclosed
- 2026-09-16: advisory