Is CVE-2026-27600 actively exploited?

CVE-2026-27600 has no public evidence of in-the-wild exploitation as of 2026-03-05.

What is the CVSS score for CVE-2026-27600?

CVE-2026-27600 has a CVSS score of 5 (MEDIUM severity). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N.

How do I patch CVE-2026-27600?

Patch guidance is available from sysadminsmedia security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2026-27600.

Which products are affected by CVE-2026-27600?

1 product: sysadminsmedia homebox.

CVE-2026-27600 - remediation guidance & executive summary

Description

HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, the notifier functionality allows authenticated users to specify arbitrary URLs to which the application sends HTTP POST requests. No validation or restriction is applied to the supplied host, IP address, or port. Although the application does not return the response body from the target service, its UI behavior differs depending on the network state of the destination. This creates a behavioral side-channel that enables internal service enumeration. This vulnerability is fixed in 0.24.0-rc.1.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Attack Vector: network
Complexity: low
Privileges: low
User Action: none
Scope: changed
Confidentiality: low
Integrity: none
Availability: none
Weaknesses: CWE-918 · Server-Side Request Forgery

Metadata

Primary Vendor: SYSADMINSMEDIA
Published: 3/3/2026
Last Modified: 3/5/2026
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

sysadminsmedia : homebox

Remediation Guidance

Executive Summary

Cite this page

CVE-2026-27600. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2026-27600

View on NIST NVD

CVE-2026-27600 vulnerability