CVE-2026-27696

{
    "cve": {
        "id": "CVE-2026-27696",
        "cveTags": [],
        "metrics": {
            "cvssMetricV31": [
                {
                    "type": "Secondary",
                    "source": "security-advisories@github.com",
                    "cvssData": {
                        "scope": "CHANGED",
                        "version": "3.1",
                        "baseScore": 8.6,
                        "attackVector": "NETWORK",
                        "baseSeverity": "HIGH",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
                        "integrityImpact": "NONE",
                        "userInteraction": "NONE",
                        "attackComplexity": "LOW",
                        "availabilityImpact": "NONE",
                        "privilegesRequired": "NONE",
                        "confidentialityImpact": "HIGH"
                    },
                    "impactScore": 4,
                    "exploitabilityScore": 3.9
                }
            ]
        },
        "published": "2026-02-25T05:17:26.940",
        "references": [
            {
                "url": "https://github.com/dgtlmoon/changedetection.io/commit/fe7aa38c651d73fe5f41ce09855fa8f97193747b",
                "tags": [
                    "Patch"
                ],
                "source": "security-advisories@github.com"
            },
            {
                "url": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-3c45-4pj5-ch7m",
                "tags": [
                    "Exploit",
                    "Mitigation",
                    "Vendor Advisory"
                ],
                "source": "security-advisories@github.com"
            },
            {
                "url": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-3c45-4pj5-ch7m",
                "tags": [
                    "Exploit",
                    "Mitigation",
                    "Vendor Advisory"
                ],
                "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
            }
        ],
        "vulnStatus": "Analyzed",
        "weaknesses": [
            {
                "type": "Secondary",
                "source": "security-advisories@github.com",
                "description": [
                    {
                        "lang": "en",
                        "value": "CWE-918"
                    }
                ]
            }
        ],
        "descriptions": [
            {
                "lang": "en",
                "value": "changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, changedetection.io is vulnerable to Server-Side Request Forgery (SSRF) because the URL validation function `is_safe_valid_url()` does not validate the resolved IP address of watch URLs against private, loopback, or link-local address ranges. An authenticated user (or any user when no password is configured, which is the default) can add a watch for internal network URLs. The application fetches these URLs server-side, stores the response content, and makes it viewable through the web UI \u2014 enabling full data exfiltration from internal services. Version 0.54.1 contains a fix for the issue."
            },
            {
                "lang": "es",
                "value": "changedetection.io es una herramienta gratuita de c\u00f3digo abierto para la detecci\u00f3n de cambios en p\u00e1ginas web. En versiones anteriores a la 0.54.1, changedetection.io es vulnerable a la Falsificaci\u00f3n de Petici\u00f3n del Lado del Servidor (SSRF) porque la funci\u00f3n de validaci\u00f3n de URL 'is_safe_valid_url()' no valida la direcci\u00f3n IP resuelta de las URL de vigilancia frente a rangos de direcciones privadas, de bucle invertido o de enlace local. Un usuario autenticado (o cualquier usuario cuando no hay contrase\u00f1a configurada, que es el valor predeterminado) puede a\u00f1adir una vigilancia para URL de red internas. La aplicaci\u00f3n obtiene estas URL del lado del servidor, almacena el contenido de la respuesta y lo hace visible a trav\u00e9s de la interfaz de usuario web \u2014 lo que permite la exfiltraci\u00f3n completa de datos de servicios internos. La versi\u00f3n 0.54.1 contiene una soluci\u00f3n para el problema."
            }
        ],
        "lastModified": "2026-02-26T15:34:26.273",
        "configurations": [
            {
                "nodes": [
                    {
                        "negate": false,
                        "cpeMatch": [
                            {
                                "criteria": "cpe:2.3:a:webtechnologies:changedetection:*:*:*:*:*:*:*:*",
                                "vulnerable": true,
                                "matchCriteriaId": "582BB3C2-9FD0-4217-A5DF-67ACC72BA029",
                                "versionEndExcluding": "0.54.1"
                            }
                        ],
                        "operator": "OR"
                    }
                ]
            }
        ],
        "sourceIdentifier": "security-advisories@github.com"
    }
}