CVE-2026-27600
Last modified
CVE-2026-27600 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, the notifier functionality allows authenticated users to specify arbitrary URLs to which the application sends HTTP POST requests. EPSS estimates a 0.19% chance of exploitation in the next 30 days.
Description
HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, the notifier functionality allows authenticated users to specify arbitrary URLs to which the application sends HTTP POST requests. No validation or restriction is applied to the supplied host, IP address, or port. Although the application does not return the response body from the target service, its UI behavior differs depending on the network state of the destination. This creates a behavioral side-channel that enables internal service enumeration. This vulnerability is fixed in 0.24.0-rc.1.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sysadminsmedia | Homebox | <= 0.23.1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-27600?
How severe is CVE-2026-27600?
How do I fix CVE-2026-27600?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-27595Parse Dashboard is a standalone dashboard for managing Parse…7.5
- CVE-2026-27596Exiv2 is a C++ library and a command-line utility to read, w…7.5
- CVE-2026-27597Enclave is a secure JavaScript sandbox designed for safe AI …10
- CVE-2026-27598Dagu is a workflow engine with a built-in Web user interface…6.5
- CVE-2026-27599CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a …7.2
- CVE-2026-2760Sandbox escape due to incorrect boundary conditions in the G…10
- CVE-2026-27601Underscore.js is a utility-belt library for JavaScript. Prio…5.9
- CVE-2026-27602Modoboa is a mail hosting and management platform. Prior to …7.2
- CVE-2026-27603Chartbrew is an open-source web application that can connect…7.5
- CVE-2026-27604FOSSBilling is a free, open-source billing and client manage…10
- CVE-2026-27605Chartbrew is an open-source web application that can connect…5.4
- CVE-2026-27606Rollup is a module bundler for JavaScript. Versions prior to…9.8
Are you affected by CVE-2026-27600?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST