CVE-2026-27600
MEDIUMHomeBox < 0.23.1 - Authenticated Server-Side Request Forgery via Notifier URL Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2026-27600. PoCs published by G3XAR.
AI-analyzed exploit summary This repository contains a functional SSRF scanner for CVE-2026-27600, targeting Homebox versions < 0.23.1. The exploit leverages the notifier functionality to perform internal port scanning via a blind SSRF vulnerability.
Description
HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, the notifier functionality allows authenticated users to specify arbitrary URLs to which the application sends HTTP POST requests. No validation or restriction is applied to the supplied host, IP address, or port. Although the application does not return the response body from the target service, its UI behavior differs depending on the network state of the destination. This creates a behavioral side-channel that enables internal service enumeration. This vulnerability is fixed in 0.24.0-rc.1.
Exploits (1)
This repository contains a functional SSRF scanner for CVE-2026-27600, targeting Homebox versions < 0.23.1. The exploit leverages the notifier functionality to perform internal port scanning via a blind SSRF vulnerability.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N