CVE-2026-27796

7.5 highEPSS 1.2%

High (7.5) in homarr homarr. EPSS 1.2% chance of exploitation in the next 30 days.

Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is exposed as a publicProcedure, allowing unauthenticated users to retrieve a complete list of configured integrations. This metadata includes sensitive information such as internal service URLs, integration names, and service types. This issue has been patched in version 1.54.0.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
CWEs: CWE-200, CWE-862
Published: 2026-03-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

homarr:homarr

References

https://github.com/homarr-labs/homarr/commit/91fc5a5c747121475a50f2713d571ceb89e95257
https://github.com/homarr-labs/homarr/releases/tag/v1.54.0
https://github.com/homarr-labs/homarr/security/advisories/GHSA-m4vc-4prp-cvp7

Check your stack JSON