GHSA-4gp5-59x3-vhhg: Homebox generic notifier SSRF via HTTP redirect after URL validation

Published Oct 27, 2026

Updated

HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs with ValidateNotifierURL before creation, update, testing, and scheduled delivery, but shoutrrr sends the request through http.DefaultClient.Do without a CheckRedirect policy that revalidates each Location target. An authenticated collection member can configure a permitted notifier host that redirects to loopback, link-local, cloud metadata, or another blocked destination, causing the follow-up request to bypass the product's SSRF policy. The flaw is reachable through POST /api/v1/notifiers/test for immediate requests and through stored notifiers during scheduled maintenance delivery. This issue is fixed in version 0.27.0.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade HomeBox to a version that resolves this vulnerability.
Fixed in 0.27.0

Event History

Oct 27, 2026

CVE Published

via OSV·05:43 PM

Data Sourced

via OSV·05:43 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Homebox collection member can exploit it by configuring a generic notifier URL on a permitted host that redirects to a blocked destination. The issue is therefore not exploitable by an unauthenticated remote attacker based on the available information.

Which request paths can trigger the SSRF?

The issue can be triggered immediately through POST /api/v1/notifiers/test. It can also be triggered later when a stored notifier is used during scheduled maintenance delivery.

Are default URL validation controls sufficient protection?

No. Homebox validates the initially configured notifier URL, but redirect targets are followed by the HTTP client without being revalidated. A permitted initial host can therefore redirect the request to loopback, link-local, cloud metadata, or another destination blocked by the SSRF policy.

What should be done if an upgrade cannot be applied immediately?

Restrict notifier configuration and testing to trusted collection members, since authenticated collection members can create the redirecting notifier configuration. Review existing stored notifier URLs for permitted hosts that may redirect to internal or otherwise blocked destinations.

How can I determine whether my deployment is affected?

Homebox versions prior to 0.27.0 are affected. Check whether collection members can configure generic notifiers and whether existing notifier URLs point to hosts that can issue redirects.

GHSA-4gp5-59x3-vhhg: Homebox generic notifier SSRF via HTTP redirect after URL validation

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which request paths can trigger the SSRF?

Are default URL validation controls sufficient protection?

What should be done if an upgrade cannot be applied immediately?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which request paths can trigger the SSRF?

Are default URL validation controls sufficient protection?

What should be done if an upgrade cannot be applied immediately?

How can I determine whether my deployment is affected?