Read the docs
TI-2026-40030 Aliases CVE-2026-55473

Server-side request forgery in sysadminsmedia homebox

Priority LOW 27CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

HomeBox is a home inventory and organization system. Prior to 0.26.0, the default-on BlockBogonNets and BlockCloudMetadata notifier SSRF protections in backend/internal/sys/validate/notifier_url.go do not inspect IPv4 destinations embedded in the NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48. An authenticated user can submit a generic:// notifier through POST /v1/notifiers or POST /v1/notifiers/test, and on a Homebox instance that egresses through NAT64/DNS64, the gateway can translate an accepted IPv6 destination to cloud metadata, localhost, or another internal IPv4 host. The notifier test path returns delivery result information, and Shoutrrr propagates the response, providing feedback that can disclose retrieved metadata such as temporary credentials. Without NAT64 egress, the crafted IPv6 destination is not routable, but the guard still incorrectly classifies it as safe. This issue is fixed in version 0.26.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00414 35th percentileScored 2026-11-07
Fix Fixed homebox (sysadminsmedia): 0.26.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sysadminsmediahomeboxbefore 0.26.00.26.0Patch availableCNA
  • homebox Vendorsysadminsmedia Affected before 0.26.0 Fixed in 0.26.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:sysadminsmedia:homebox:*:*:*:*:*:*:*:*——sysadminsmedia
  • cpe:2.3:a:sysadminsmedia:homebox:*:*:*:*:*:*:*:* Versions — — ·sysadminsmedia

Remediation

  • Fix · CNA homebox (sysadminsmedia) Fixed in 0.26.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55473

References

Other 3

  • TI-2026-36232 HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack CVSS 3.1HIGH 8.1
  • TI-2026-36231 Authorization bypass in sysadminsmedia homebox CVSS 3.1HIGH 8.1
  • TI-2026-29010 HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation CVSS 3.1HIGH 8.1
  • TI-2026-36094 HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching CVSS 3.1HIGH 8.1
  • TI-2026-22323 HomeBox has an Auth Rate Limit Bypass via IP Spoofing CVSS 3.1HIGH 7.4
  • TI-2026-85499 Email case sensitivity in HomeBox allows duplicate accounts CVSS 3.1MEDIUM 6.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences