CVE-2026-27796: fallo de gravedad media en homarr-labs homarr
Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak)
Publicada el · Actualizada el
28Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendcvss 5.3epss 1.2%
probabilidad de explotación
1.2%top 33% de las CVE
explotación observada
noninguna fuente lo reporta
Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is exposed as a publicProcedure, allowing unauthenticated users to retrieve a complete list of configured integrations. This metadata includes sensitive information such as internal service URLs, integration names, and service types. This issue has been patched in version 1.54.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
homarr-labs · homarrCVEs relacionadas — homarr-labs homarr
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-27797MEDIUMHomarr: Unauthenticated SSRF in rssFeed.tsEPSS 0.5%CVE-2026-33510HIGHDOM-Based XSS in Homarr /auth/login RedirectEPSS 0.3%CVE-2025-64759HIGHHomarr is Vulnerable to Stored Cross-Site Scripting (XSS) and Possible Privilege Escalation via Malicious SVG UploadEPSS 0.3%CVE-2025-67493HIGHHomarr: missing input sanitization and possible privilege escalation through ldap search query injectionEPSS 0.3%CVE-2026-25123MEDIUMHomarr affected by Unauthenticated SSRF / Port-Scan Primitive via widget.app.pingEPSS 0.3%CVE-2026-32602MEDIUMHomarr has a Race Condition in Invite Token Registration (TOCTOU)EPSS 0.2%