TI-2026-21986 Aliases CVE-2026-27600

HomeBox affected by Blind SSRF

LOW 22CWE-918Published 2026-03-03 · Updated 2026-03-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, the notifier functionality allows authenticated users to specify arbitrary URLs to which the application sends HTTP POST requests. No validation or restriction is applied to the supplied host, IP address, or port. Although the application does not return the response body from the target service, its UI behavior differs depending on the network state of the destination. This creates a behavioral side-channel that enables internal service enumeration. This vulnerability is fixed in 0.24.0-rc.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00212 11th percentileScored 2026-11-07

Fix Fixed homebox (sysadminsmedia): 0.24.0-rc.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
sysadminsmedia	homebox	before 0.24.0-rc.1	0.24.0-rc.1	Patch available	CNA

homebox Vendorsysadminsmedia Affected before 0.24.0-rc.1 Fixed in 0.24.0-rc.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sysadminsmedia:homebox::::::::	up to 0.23.1	Vulnerable	sysadminsmedia

cpe:2.3:a:sysadminsmedia:homebox:*:*:*:*:*:*:*:* Versions up to 0.23.1 Vulnerable ·sysadminsmedia

Remediation

Fix · CNA homebox (sysadminsmedia) Fixed in 0.24.0-rc.1

Timeline

2026-10-02 Threatist record created from CVE-2026-27600

References

Advisory 1

https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-cm7p-5mg5-82pm

TI-2026-29010 HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation CVSS 3.1HIGH 8.1
TI-2026-22323 HomeBox has an Auth Rate Limit Bypass via IP Spoofing CVSS 3.1HIGH 7.4
TI-2026-21242 HomeBox affected by Stored XSS via HTML/SVG Attachment Upload CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences