CVE-2026-116680 Details
Description
HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs with ValidateNotifierURL before creation, update, testing, and scheduled delivery, but shoutrrr sends the request through http.DefaultClient.Do without a CheckRedirect policy that revalidates each Location target. An authenticated collection member can configure a permitted notifier host that redirects to loopback, link-local, cloud metadata, or another blocked destination, causing the follow-up request to bypass the product's SSRF policy. The flaw is reachable through POST /api/v1/notifiers/test for immediate requests and through stored notifiers during scheduled maintenance delivery. This issue is fixed in version 0.27.0.
A server-side request forgery (SSRF) vulnerability has been identified in Homebox, a home inventory and organization system, in versions prior to 0.27.0. The issue arises because the application validates generic notifier URLs against a set of rules to block access to localhost, link-local addresses, cloud metadata, and other specified destinations. However, when the notifiers are delivered, the application uses a generic service that follows HTTP redirects without revalidating the target locations. This allows an authenticated user to create a notifier that redirects to a blocked destination, bypassing the application's security controls. The vulnerability can be exploited immediately by testing the notifier or during scheduled maintenance deliveries using stored notifiers.
Users can update to Homebox version 0.27.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sysadminsmedia/homebox/commit/52eb6f3511bf239bcf34a87a4d13cedd2f704122 | [email protected] | Source CodeVendor |
| https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.0 | [email protected] | Release NotesVendor |
| https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-4gp5-59x3-vhhg | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sysadminsmedia Homebox | <= 0.26.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |