CVE-2026-116680

Name of the Vulnerable Software and Affected Versions HomeBox versions prior to 0.27.0

Description HomeBox fails to revalidate redirect targets when sending requests via the shoutrrr library, as it uses http.DefaultClient.Do without a CheckRedirect policy. An authenticated collection member can configure a permitted notifier host that redirects to loopback, link-local, cloud metadata, or other blocked destinations, bypassing the Server-Side Request Forgery (SSRF) policy. SSRF is a flaw where an attacker forces a server to make requests to an unintended location. This issue is reachable through the 'POST /api/v1/notifiers/test' endpoint for immediate requests and through stored notifiers during scheduled maintenance delivery. The flaw involves the ValidateNotifierURL function.

Recommendations Update HomeBox to version 0.27.0.