HomeBox EUVD-2026-111277

Requires an authenticated account with membership in any Homebox collection (notifier creation is not owner-restricted). The attacker must control an HTTP endpoint whose initial hostname passes ValidateNotifierURL (block localhost/RFC1918/bogon/cloud-metadata/custom nets) and that then returns a 302/307/308 redirect to an otherwise-blocked destination; the follow-up hop is delivered via shoutrrr over http.DefaultClient with no CheckRedirect, bypassing the SSRF policy. The flaw is reachable immediately through POST /api/v1/notifiers/test and asynchronously through stored notifiers during scheduled maintenance delivery. Limiting factors: valid authentication is required, the attacker must operate the redirecting server, exploitation only yields value where the operator has internal/link-local/metadata targets reachable from the Homebox host, and the SSRF guards must be enabled for the redirect bypass to represent an actual control failure. Affects versions prior to 0.27.0.

This is a genuine but moderate-priority issue, not a drop-everything emergency. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) is internally consistent with the advisory: network-reachable, low complexity, and authenticated (PR:L) - any collection member, not just an owner, can create notifiers. The scope change (S:C) reflects that a successful SSRF reaches components beyond Homebox itself (loopback services, link-local, cloud metadata). No EPSS score was supplied in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and there is no public exploit identified at time of analysis - the only public artifacts are the GHSA advisory, the fix commit, and the 0.27.0 release, all of which describe the fix rather than a weaponized exploit. The vuln.today decision label is 'this_month', consistent with a real-but-contained SSRF requiring authentication and an attacker-controlled redirecting host. The practical risk is bounded by two gates: the attacker needs a valid authenticated account/collection membership, and the deployment must actually have internal/metadata targets worth reaching (and operator SSRF blockers configured for the bypass to be meaningful). It is a legitimate defense-in-depth failure worth patching promptly, but the authentication requirement and the self-hosted deployment profile keep it well below the urgency of an unauthenticated internet-facing SSRF.

An authenticated Homebox collection member configures a generic notifier pointing at an attacker-controlled host that passes the ValidateNotifierURL gate. When the member triggers POST /api/v1/notifiers/test (or waits for scheduled maintenance delivery of a stored notifier), that host returns a 302/307/308 redirect to http://169.254.169.254/ or http://127.0.0.1/, and because shoutrrr's delivery through http.DefaultClient has no CheckRedirect policy, Homebox follows the redirect without re-validating it - reaching cloud metadata or internal services behind the host's SSRF controls. No public exploit code was identified in the input; the attack mechanism is as described in the GHSA advisory and the fix commit.