ZeroDay Findings
Sign inSign up

Findings

CVE-2026-27600

HomeBox is a home inventory and organization system.

Published Mar 3, 2026 · updated Jun 17, 2026 · sysadminsmedia homebox

HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, the notifier functionality allows authenticated users to specify arbitrary URLs to which the application sends HTTP POST requests. No validation or restriction is applied to the supplied host, IP address, or port. Although the application does not return the response body from the target service, its UI behavior differs depending on the network state of the destination. This creates a behavioral side-channel that enables internal service enumeration. This vulnerability is fixed in 0.24.0-rc.1.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 3, 2026 · NIST NVD

    Detected

    HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, the notifier functionality allows authenticated users to specify arbitrary URLs to which the application sends HTTP POST requests. No validation or restriction is applied to the supplied host, IP address, or port. Although the application does not return the response body from the target service, its UI behavior differs dep

  2. Jun 17, 2026 · NIST NVD

    Updated

    HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, the notifier functionality allows authenticated users to specify arbitrary URLs to which the application sends HTTP POST requests. No validation or restriction is applied to the supplied host, IP address, or port. Although the application does not return the response body from the target service, its UI behavior differs dep

Affected

  • cpe sysadminsmedia/homeboxversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-27600

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-27600

    HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, the notifier functionality allows authenticated users to specify arbitrary URLs to which the application sends HTTP POST requests. No validation or restriction is applied to the supplied host, IP address,

    nvd.nist.gov

References