CVE-2026-27796

Published: Mar 7, 2026Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is exposed as a publicProcedure, allowing unauthenticated users to retrieve a complete list of configured integrations. This metadata includes sensitive information such as internal service URLs, integration names, and service types. This issue has been patched in version 1.54.0.

Affected (1)

Products: Homarr: Homarr

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Homarr Homarr	Before 1.54.0

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (3)

https://github.com/homarr-labs/homarr/commit/91fc5a5c747121475a50f2713d571ceb89e95257

Source: security-advisories@github.com

Patch

https://github.com/homarr-labs/homarr/releases/tag/v1.54.0

Source: security-advisories@github.com

Release Notes

https://github.com/homarr-labs/homarr/security/advisories/GHSA-m4vc-4prp-cvp7

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.