CVE-2026-27600
Behavioral Side-Channel in HomeBox Notifier Enables Internal Enumeration
Publication date: 2026-03-03
Last updated on: 2026-03-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sysadminsmedia | homebox | to 0.23.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the HomeBox home inventory and organization system prior to version 0.24.0-rc.1. Authenticated users can specify arbitrary URLs for the application to send HTTP POST requests to without any validation or restriction on the host, IP address, or port. Although the application does not reveal the response body from these requests, the user interface behaves differently based on the network state of the destination. This difference in behavior creates a side-channel that allows attackers to enumerate internal services.
How can this vulnerability impact me? :
This vulnerability can allow an authenticated user to perform internal service enumeration by exploiting the behavioral side-channel created by the notifier functionality. This means an attacker could gain information about internal network services that are not normally exposed, potentially aiding further attacks or reconnaissance within the network.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed in HomeBox version 0.24.0-rc.1. Immediate mitigation involves upgrading the application to this version or later.
Since the issue arises from the notifier functionality allowing arbitrary URLs without validation, restricting or disabling this feature until the upgrade is applied can reduce risk.