An authenticated user, or any user when no password is configured, can specify a watch URL that points to an internal, private, loopback, or link‑local address. The application does not validate the resolved IP against these ranges, allowing it to fetch any resource reachable from the host. The fetched content is stored and presented in the web interface, enabling full exfiltration of internal data. This flaw constitutes a high‑severity SSRF vulnerability, represented by CWE‑918.

The affected product is changedetection.io provided by dgtlmoon. Versions prior to 0.54.1 are vulnerable. All installations that have enabled the watch feature and are accessible to an attacker could be impacted.

The CVSS scoring is 8.6, indicating high severity. The EPSS probability is less than 1%, suggesting that exploitation is not common yet, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely remote or local, depending on network exposure and whether the instance allows unauthenticated access, which is the default scenario. Once the attacker can submit a watch URL, they can retrieve any internal service data that the host can reach, effectively compromising confidentiality of internal infrastructure.