Description
A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function add_watch_ui_snapshot of the file changedetectionio/blueprint/add_watch_ui/__init__.py of the component Preview Endpoint. Performing a manipulation of the argument url results in server-side request forgery. The attack can be initiated remotely. The exploit has been made public and could be used. Upgrading to version 0.60.1 is able to resolve this issue. The patch is named 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e. The affected component should be upgraded. Was fixed upstream.
Published: 2026-09-22
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Server-side request forgery
Action: Immediate Patch
AI Analysis

Impact

The add_watch_ui_snapshot function in the preview endpoint of changedetection.io can be manipulated by supplying a crafted URL. This allows an attacker to trigger arbitrary outbound HTTP requests from the server, a classic server-side request forgery (SSRF) flaw. The vulnerability can be exploited remotely, and a public exploit has been released, meaning attackers can easily target vulnerable installations.

Affected Systems

This issue affects all releases of dgtlmoon changedetection.io prior to version 0.60.1, including the code base up to commit 50389b07. The fix is included in the 0.60.1 release, and upgrading to that version or later removes the flaw.

Risk and Exploitability

With a CVSS score of 6.9 the vulnerability is moderate, but the lack of an EPSS score and its absence from the KEV catalog do not diminish the risk because the flaw is exploitable remotely and a public exploit is available. Attackers can use SSRF to reach internal networks or third‑party services, potentially exposing sensitive data or enabling further attacks. The high attack surface and lack of authentication mitigate factors make timely remediation critical.

Generated by OpenCVE AI on September 22, 2026 at 19:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade changedetection.io to version 0.60.1 or later to apply the SSRF fix.
  • If an upgrade is not immediately possible, disable or restrict access to the add_watch_ui_snapshot preview endpoint, or place a firewall rule to block outbound requests originating from the application so that any server‑side requests made by the application go through a monitored and filtered path, reducing the risk of internal data exposure.
  • Configure the application or reverse proxy to restrict outbound requests to a whitelist of trusted domains, preventing the application from reaching internal IP ranges.

Generated by OpenCVE AI on September 22, 2026 at 19:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 22 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function add_watch_ui_snapshot of the file changedetectionio/blueprint/add_watch_ui/__init__.py of the component Preview Endpoint. Performing a manipulation of the argument url results in server-side request forgery. The attack can be initiated remotely. The exploit has been made public and could be used. Upgrading to version 0.60.1 is able to resolve this issue. The patch is named 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e. The affected component should be upgraded. Was fixed upstream.
Title dgtlmoon changedetection.io Preview Endpoint __init__.py add_watch_ui_snapshot server-side request forgery
First Time appeared Dgtlmoon
Dgtlmoon changedetection.io
Weaknesses CWE-918
CPEs cpe:2.3:a:dgtlmoon:changedetection.io:*:*:*:*:*:*:*:*
Vendors & Products Dgtlmoon
Dgtlmoon changedetection.io
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Dgtlmoon Changedetection.io
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-22T17:39:35.156Z

Reserved: 2026-09-22T12:29:58.831Z

Link: CVE-2026-95656

cve-icon Vulnrichment

Updated: 2026-09-22T17:39:16.842Z

cve-icon NVD

Status : Deferred

Published: 2026-09-22T18:17:36.947

Modified: 2026-09-22T19:04:55.677

Link: CVE-2026-95656

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T19:30:14Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)