Skip to content
Sysadminsmedia Homebox vulnerabilities
-
sysadminsmedia homebox
HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service
CVE-2026-85287
6.5 Medium
-
sysadminsmedia homebox
HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields
CVE-2026-75599
5.4 Medium
-
sysadminsmedia homebox
HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay
CVE-2026-85286
3.7 Low
-
sysadminsmedia homebox
Homebox generic notifier SSRF via HTTP redirect after URL validation
CVE-2026-116680
6.4 Medium
-
sysadminsmedia homebox
HomeBox: Notifier SSRF guard misses NAT64 prefixes (64:ff9b::/96, 64:ff9b:1::/48) — generic:// URL reaches cloud metadata on NAT64 egress
CVE-2026-55473
6.0 Medium
-
sysadminsmedia homebox
HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching
CVE-2026-48826
8.1 High
-
sysadminsmedia homebox
HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler
CVE-2026-48974
5.4 Medium
-
sysadminsmedia homebox
HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox
CVE-2026-48975
8.1 High
-
sysadminsmedia homebox
HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack
CVE-2026-48976
8.1 High
-
sysadminsmedia homebox
HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation
CVE-2026-40196
8.1 High
-
sysadminsmedia homebox
HomeBox has an Auth Rate Limit Bypass via IP Spoofing
CVE-2026-27981
7.4 High
-
sysadminsmedia homebox
HomeBox affected by Blind SSRF
CVE-2026-27600
5.0 Medium
-
sysadminsmedia homebox
HomeBox affected by Stored XSS via HTML/SVG Attachment Upload
CVE-2026-26272
4.6 Medium
-
sysadminsmedia homebox
HomeBox Missing User Authorization
CVE-2025-53108
5.3 Medium