CVE-2026-92815 is a Server-Side Request Forgery vulnerability in changedetection.io through version 0.60.6. The application does not properly validate the Goto URL action in browser steps, enabling unauthenticated attackers to specify arbitrary internal URLs in the optional_value parameter. This can lead to unauthorized retrieval of responses from internal or restricted network locations, bypassing intended access controls.

An attacker can exploit this vulnerability without authentication to access internal network resources that should be restricted. This could lead to information disclosure from internal systems not normally accessible externally. The CVSS 4.0 base score is 8.7 (high severity), reflecting the network attack vector, no required privileges or user interaction, and high impact on confidentiality.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected changedetection.io instances and monitor for suspicious activity related to the Goto URL action. Avoid exposing the service to untrusted networks.