MEDIUM🇬🇧 English

CVE-2026-27796

CVSS 5.3v3.1pub. 2026-03-07upd. 2026-03-10

Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is exposed as a publicProcedure, allowing unauthenticated users to retrieve a complete list of configured integrations. This metadata includes sensitive information such as internal service URLs, integration names, and service types. This issue has been patched in version 1.54.0.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

  • Homarr

    APP
    Homarr
    < 1.54.0
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2025-54313HIGH7.5⚠ KEVten sam produkt

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compro...

CVE-2026-33510HIGH8.8ten sam produkt

Homarr is an open-source dashboard. Prior to 1.57.0, a DOM-based Cross-Site Scripting (XSS) vulnerability has ...

CVE-2025-67493HIGH7.5ten sam produkt

Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed p...

CVE-2025-64759HIGH8.1ten sam produkt

Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the exe...

CVE-2026-32602MEDIUM4.2ten sam produkt

Homarr is an open-source dashboard. Prior to 1.57.0, the user registration endpoint (/api/trpc/user.register) ...