CVE-2026-27696: changedetection.io is Vulnerable to SSRF via Watch URLs

Changedetection.io is vulnerable to Server-Side Request Forgery (SSRF) because the URL validation function is_safe_valid_url() does not validate the resolved IP address of watch URLs against private, loopback, or link-local address ranges. An authenticated user (or any user when no password is configured, which is the default) can add a watch for internal network URLs such as:

• http://169.254.169.254
• http://10.0.0.1/
• http://127.0.0.1/

The application fetches these URLs server-side, stores the response content, and makes it viewable through the web UI — enabling full data exfiltration from internal services.

This is particularly severe because:

• The fetched content is stored and viewable - this is not a blind SSRF
• Watches are fetched periodically - creating a persistent SSRF that continuously accesses internal resources
• By default, no password is set - the web UI is accessible without authentication
• Self-hosted deployments typically run on cloud infrastructure where 169.254.169.254 returns real IAM credentials