CVE-2026-116680 in Homebox
Summary
by MITRE • 10/27/2026
HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs with ValidateNotifierURL before creation, update, testing, and scheduled delivery, but shoutrrr sends the request through http.DefaultClient.Do without a CheckRedirect policy that revalidates each Location target. An authenticated collection member can configure a permitted notifier host that redirects to loopback, link-local, cloud metadata, or another blocked destination, causing the follow-up request to bypass the product's SSRF policy. The flaw is reachable through POST /api/v1/notifiers/test for immediate requests and through stored notifiers during scheduled maintenance delivery. This issue is fixed in version 0.27.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/27/2026
HomeBox, a home inventory and organization system, contains a Server-Side Request Forgery vulnerability that allows authenticated users to bypass URL validation controls by exploiting the behavior of its underlying notification library. The application employs a function named ValidateNotifierURL to verify notifier URLs during creation, updates, testing via POST /api/v1/notifiers/test, and scheduled maintenance deliveries. This initial validation ensures that only permitted hosts are configured for notifications. However, when sending these requests, HomeBox relies on the shoutrrr library which utilizes Go's http.DefaultClient.Do method without configuring a CheckRedirect policy to revalidate URLs after redirections occur.
The core technical flaw lies in the lack of redirect validation. When an authenticated collection member configures a notifier with a permitted host that issues an HTTP redirect, such as a 301 or 302 status code, the client automatically follows this redirect without performing any further security checks on the new Location target. This architectural oversight means that while the initial URL may pass validation by pointing to an allowed domain, the final request can be directed to arbitrary internal addresses including loopback interfaces like localhost, link-local networks, cloud metadata endpoints such as 169.254.169.254, or other blocked destinations within the network perimeter. This effectively bypasses the SSRF policy implemented by HomeBox because the security control is only applied at the entry point and not during the request lifecycle after redirections are processed.
The operational impact of this vulnerability is significant for environments where HomeBox runs with access to internal services or cloud metadata APIs. An attacker who has obtained valid authentication credentials can exploit this flaw to perform SSRF attacks against local infrastructure, potentially accessing sensitive configuration data from cloud provider metadata endpoints, scanning internal network ports, or interacting with other services running on the host machine that are not exposed externally. This capability could lead to further compromise of the underlying system if combined with other vulnerabilities in adjacent services. The vulnerability is exploitable both immediately through the test notifier endpoint and persistently through stored notifiers during scheduled maintenance deliveries, providing multiple attack vectors for exploitation.
This issue aligns with CWE-918 Server-Side Request Forgery (SSRF) as it involves an attacker influencing server-side request initiation to access internal resources. It also relates to ATT&CK technique T1560 Lateral Tool Transfer or potentially data exfiltration depending on the specific target accessed via SSRF, though primarily it represents a mechanism for bypassing security controls which falls under Defense Evasion techniques such as T1211 Exploitation for Defense Evasion. The flaw highlights the importance of validating URLs at every stage of request processing, particularly after redirects, to prevent protocol smuggling or redirection-based bypasses.
The vulnerability has been addressed in HomeBox version 0.27.0 by implementing proper redirect validation logic within the HTTP client configuration. Administrators should upgrade immediately to this patched version to mitigate the risk of SSRF attacks through notifier configurations. In addition to upgrading, organizations running older versions should restrict network access to internal services and cloud metadata endpoints from the host where HomeBox is deployed as a compensating control. It is also recommended to enforce strict input validation on all user-supplied URLs that are processed by HTTP clients in similar applications to ensure that redirect targets are validated against an allowlist just like initial requests.