CVE-2026-27696 json
changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs
published 2026-02-25 8 mo ago modified 2026-07-13 3 mo ago also EUVD-2026-8622 , GHSA-3c45-4pj5-ch7m , PYSEC-2026-2126
- cvss
- 8.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 42%
- public exploits
- 0
- none known
Summary
changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, changedetection.io is vulnerable to Server-Side Request Forgery (SSRF) because the URL validation function `is_safe_valid_url()` does not validate the resolved IP address of watch URLs against private, loopback, or link-local address ranges. An authenticated user (or any user when no password is configured, which is the default) can add a watch for internal network URLs. The application fetches these URLs server-side, stores the response content, and makes it viewable through the web UI — enabling full data exfiltration from internal services. Version 0.54.1 contains a fix for the issue.
Patch / fix
- pypi changedetection-io 0.54.1
- changedetection changedetection 0.54.1
- webtechnologies changedetection 0.54.1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.50% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-3c45-4pj5-ch7m referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| GitHub | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| OSV | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | changedetection-io | <0.54.1 |
0.54.1 |
Affected products
- dgtlmoon changedetection.io
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/dgtlmoon/changedetection.io/commit/fe7aa38c651d73fe5f41ce09855fa8f97193747b
web, patch
-
github.com
/dgtlmoon/changedetection.io/security/advisories/GHSA-3c45-4pj5-ch7m
exploit, web, mitigation, vendor-advisory, evidence
-
nvd.nist.gov
/vuln/detail/CVE-2026-27696
advisory
-
github.com
/dgtlmoon/changedetection.io
package
Sources
- CVE List CVE-2026-27696
- GitHub Advisory GHSA-3c45-4pj5-ch7m
- NVD CVE-2026-27696
- OSV PYSEC-2026-2126
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.