Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-27600

HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, the notifier functionality allows authenticated users to specify arbitrary URLs to which the application sends HTTP POST requests. No validation or restriction is applied to the supplied host, IP address, or port. Although the application does not return the response body from the target service, its UI behavior differs depending on the network state of the destination. This creates a behavioral side-channel that enables
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:adcc2546c15776d59c9a35f3a555ea4be480ffa3c75583f76caeaa402d5f620d
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"homebox","vendor":"sysadminsmedia","versions":[{"status":"affected","version":"< 0.24.0-rc.1"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:a671fd9f3eacbc1404e8f736e17806aa2e33a83db965a147155246f0abe542b9 · sha256:f554725715bbe9a7… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:a671fd9f3eacbc1404e8f736e17806aa2e33a83db965a147155246f0abe542b9 · sha256:f554725715bbe9a7… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-918","description":"CWE-918: Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:a671fd9f3eacbc1404e8f736e17806aa2e33a83db965a147155246f0abe542b9 · sha256:f554725715bbe9a7… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion
{"name":"https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-cm7p-5mg5-82pm","tags":["x_refsource_CONFIRM"],"url":"https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-cm7p-5mg5-82pm"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a671fd9f3eacbc1404e8f736e17806aa2e33a83db965a147155246f0abe542b9 · sha256:f554725715bbe9a7… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer