Medium severity · published Mar 3, 2026
CVE-2026-27600
HomeBox affected by Blind SSRF
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, the notifier functionality allows authenticated users to specify arbitrary URLs to which the application sends HTTP POST requests. No validation or restriction is applied to the supplied host, IP address, or port. Although the application does not return the response body from the target service, its UI behavior differs depending on the network state of the destination. This creates a behavioral side-channel that enables internal service enumeration. This vulnerability is fixed in 0.24.0-rc.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HO
homebox · sysadminsmedia
< 0.24.0-rc.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27600
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27600
Vendor Advisory
https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-cm7p-5mg5-82pm
More from homebox
8.1
CVE-2026-48826
HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching
8.1
CVE-2026-48975
HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox
8.1
CVE-2026-48976
HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack
8.1
CVE-2026-40196
HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation
7.4
CVE-2026-27981
HomeBox has an Auth Rate Limit Bypass via IP Spoofing