SSRF Vulnerability in HomeBox's URL Validation Process
CVE-2026-116680

6.4MEDIUM

Key Information:

Vendor

Sysadminsmedia

Status
Homebox
Vendor
CVE Published:
27 October 2026

What is CVE-2026-116680?

HomeBox, a home inventory and organization system, contains a vulnerability in its notifier URL validation process that can lead to unintended server-side request forgery (SSRF). The flaw allows authenticated users to exploit improperly validated URLs, which could redirect requests to sensitive internal resources or potentially malicious endpoints, bypassing the established security controls. This vulnerability is accessible via a POST request to /api/v1/notifiers/test and can also be triggered through stored notifier configurations. A patch is available in version 0.27.0, which addresses this security issue.

Affected Version(s)

homebox < 0.27.0

References

https://github.com/sysadminsmedia/homebox/security/adviso...
x_refsource_CONFIRM
https://github.com/sysadminsmedia/homebox/commit/52eb6f35...
x_refsource_MISC
https://github.com/sysadminsmedia/homebox/releases/tag/v0...
x_refsource_MISC

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.