CVE-2026-27600: HomeBox affected by Blind SSRF
HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, the notifier functionality allows authenticated users to specify arbitrary URLs to which the application sends HTTP POST requests. No validation or restriction is applied to the supplied host, IP address, or port. Although the application does not return the response body from the target service, its UI behavior differs depending on the network state of the destination. This creates a behavioral side-channel that enables internal service enumeration. This vulnerability is fixed in 0.24.0-rc.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27600?
CVE-2026-27600 is considered a high-severity vulnerability due to the potential for unauthorized access and data exfiltration.
How do I fix CVE-2026-27600?
To mitigate CVE-2026-27600, upgrade HomeBox to version 0.24.0-rc.1 or higher, which resolves the vulnerability.
What type of vulnerability is CVE-2026-27600?
CVE-2026-27600 is classified as a Blind Server-Side Request Forgery (SSRF) vulnerability.
Who is affected by CVE-2026-27600?
Users of HomeBox versions prior to 0.24.0-rc.1 are affected by CVE-2026-27600.
What can an attacker do with CVE-2026-27600?
An attacker could exploit CVE-2026-27600 to send arbitrary HTTP requests from the server to internal or external services, which could lead to unauthorized actions.