SSRF in Sysadminsmedia Homebox
CVE-2026-27600
HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, the notifier functionality allows authenticated users to specify arbitrary URLs to which the application sends HTTP POST requests. No validation or restriction is applied to the supplied host, IP address, or port. Although the application does not return the response body from the target service, its UI behavior differs depending on the network state of the destination. This creates a behavioral side-channel that enables internal service enumeration. This vulnerability is fixed in 0.24.0-rc.1.
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.002 (8.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N.
Affected products
- Sysadminsmedia Homebox — versions < 0.24.0-rc.1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-27600?
- CVE-2026-27600 is a medium-severity vulnerability in Sysadminsmedia Homebox, classified under Server-Side Request Forgery (SSRF). CVSS score: 5.0/10. Published 2026-03-03.
- How severe is CVE-2026-27600?
- Medium severity. CVSS v3 base score is 5.0 out of 10.