Is CVE-2026-92815 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92815 being exploited in the wild.

How severe is CVE-2026-92815?

High severity, with a CVSS score of 7.5, published 16 September 2026.

Which products and versions are affected?

dgtlmoon changedetection.io through 0.60.6.

Is there a fix for CVE-2026-92815?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-92815 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-92815?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92815: changedetection.io URL validation bypass in browser steps

CVE-2026-92815 · Severity: high · CVSS 7.5 · Published 2026-09-16

changedetection.io is a website monitoring tool that tracks changes to web pages and sends alerts. The application fails to properly validate URLs in its browser automation feature, allowing attackers to make it fetch internal or restricted addresses and retrieve responses from the company network without authentication. This could expose sensitive internal services, credentials, or data that should only be accessible within the organization.

Quick answers

Is CVE-2026-92815 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92815 being exploited in the wild.
How severe is CVE-2026-92815?: High severity, with a CVSS score of 7.5, published 16 September 2026.
Which products and versions are affected?: dgtlmoon changedetection.io through 0.60.6.
Is there a fix for CVE-2026-92815?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-92815 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-92815?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an insufficient URL validation flaw in the Goto URL action within browser steps. Unauthenticated attackers can supply arbitrary internal URLs via the optional_value parameter, bypassing origin/destination validation. The application uses these URLs in browser automation workflows without proper checks, allowing Server-Side Request Forgery (SSRF)-like attacks to reach internal network locations, restricted IP ranges (including 127.0.0.1 and private subnets), and retrieve HTTP responses. No authentication is required; an attacker with access to the changedetection.io web interface can craft malicious browser steps. Patches are available in versions after 0.60.6.

Affected products

dgtlmoon changedetection.io through 0.60.6

Timeline

2026-09-16: disclosed
2026-09-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.