CVE-2026-27796

Katalog CVE

CVSS 7.5 · High EPSS 1,2%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada homarr. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is exposed as a publicProcedure, allowing unauthenticated users to retrieve a complete list of configured integrations. This metadata includes sensitive information such as internal service URLs, integration names, and service types. This issue has been patched in version 1.54.0.

Rincian

Terbit di NVD

7 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-862: Missing Authorization

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/homarr-labs/homarr/security/advisories/GHSA-m4vc-4prp-cvp7 exploit · advisory vendor
• https://github.com/homarr-labs/homarr/commit/91fc5a5c747121475a50f2713d571ceb89e95257 patch
• https://github.com/homarr-labs/homarr/releases/tag/v1.54.0 release notes