CVE-2026-116680

MEDIUM 6.4

Homebox generic notifier SSRF via HTTP redirect after URL validation

CVSS Score

6.4

EPSS Score

0.0%

EPSS Percentile

0th

HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs with ValidateNotifierURL before creation, update, testing, and scheduled delivery, but shoutrrr sends the request through http.DefaultClient.Do without a CheckRedirect policy that revalidates each Location target. An authenticated collection member can configure a permitted notifier host that redirects to loopback, link-local, cloud metadata, or another blocked destination, causing the follow-up request to bypass the product's SSRF policy. The flaw is reachable through POST /api/v1/notifiers/test for immediate requests and through stored notifiers during scheduled maintenance delivery. This issue is fixed in version 0.27.0.

CWE	CWE-918
Vendor	sysadminsmedia
Product	homebox
Published	Oct 27, 2026

Stay Ahead of the Next One

Get instant alerts for sysadminsmedia homebox

Be the first to know when new medium vulnerabilities affecting sysadminsmedia homebox are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

sysadminsmedia / homebox

< 0.27.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-4gp5-59x3-vhhg github.com: https://github.com/sysadminsmedia/homebox/commit/52eb6f3511bf239bcf34a87a4d13cedd2f704122 github.com: https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.0