CVE-2026-95271
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
A vulnerability was found in changedetection.io up to 0.60.7 in the check_authentication function of changedetectionio/flask_app.py within the Authentication Hook component. Improper validation leads to improper authentication, and the attack can be performed remotely. The exploit has been publicly disclosed and may be used; the vendor did not respond to the disclosure.
Risk Assessment
An attacker can remotely bypass authentication and gain access to protected application functionality. Since the exploit is publicly available, the risk of exploitation is high.
Recommendation
Update changedetection.io to a version newer than 0.60.7 as soon as it becomes available, or apply the vendor-recommended workaround. Until then, consider restricting network access to the instance.
Other vulnerabilities in changedetection.io
See all- CVE-2026-43891High
In the changedetection.io web page change detection tool prior to version 0.55.1, a vulnerability exists due to trusting attacker-controlled snapshot paths restored from backup files. When a backup is restored, the application may restore malicious files, including history.txt, leading to the disclosure of local file contents.
- CVE-2026-41895High
In versions 0.54.9 and earlier, changedetection.io switches to XML mode for XML/RSS content, leading to potential security issues related to processing untrusted XML data.
- CVE-2026-95657Low
A vulnerability in Changedetection.io up to 0.55.8. The function setCurrentSelectedText in visual-selector.js is affected. Manipulating the argument s can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed. Upgrading to version 0.60.1 addresses the issue. The patch is aac6fcfa594f17511b8ff73e5eaa4f6c33899de0.
- CVE-2026-95656High
A vulnerability was found in dgtlmoon changedetection.io up to 50389b07, affecting the function add_watch_ui_snapshot in changedetectionio/blueprint/add_watch_ui/__init__.py of the Preview Endpoint component. Manipulation of the url argument results in server-side request forgery (SSRF), and the attack can be initiated remotely. The exploit has been made public and could be used; upgrading to version 0.60.1 resolves the issue (patch 71d332d5a0d3da2a0fe89a392413bf4b7d27c84e).
- CVE-2026-95273Medium
A path traversal vulnerability was found in changedetection.io up to version 0.60.7, affecting the static_content function in changedetectionio/flask_app.py within the visual_selector_data component. Manipulating the filename argument allows remote exploitation. The exploit has been publicly disclosed and may be used by attackers.
- CVE-2026-95272Low
changedetection.io up to version 0.60.7 has a path traversal vulnerability in the static_content function in changedetectionio/flask_app.py in the Screenshot Handler component. Manipulating the filename argument allows a remote attack with high complexity and difficult exploitability. The exploit has been published, but the vendor did not respond.
- CVE-2026-95270Low
changedetection.io up to version 0.60.7 has a vulnerability involving an observable timing discrepancy in the check_password function in changedetectionio/flask_app.py in the Hash Comparison component. The attack can be performed remotely, requires high complexity, and is difficult to exploit. The exploit has been published, and the vendor did not respond.
- CVE-2026-92815High
changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optional_value parameter to retrieve responses from restricted network locations.
- CVE-2026-92814Medium
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watch_title token is used in templates.
- CVE-2026-71205Medium
changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).
Original NVD description (English source)
A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7. The impacted element is the function check_authentication of the file changedetectionio/flask_app.py of the component Authentication Hook. Such manipulation leads to improper authentication. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS