Skip to content
OpenAdvisories

Vendor

homarr-labs

7 known vulnerabilities.

Products

homarr 7
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 4.2
    CVE-2026-32602

    Homarr has a Race Condition in Invite Token Registration (TOCTOU)

    Homarr is an open-source dashboard. Prior to 1.57.0, the user registration endpoint (/api/trpc/user.register) is vulnerable to a race condition that allows an attacker to create multiple user accounts from a single-use invite token. The registration flow perf…

    homarr-labs homarr
  • Medium 5.3
    CVE-2026-27796 Scanner template

    Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak)

    Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is exposed as a publicProcedure, allowing unauthenticated users to retrieve a complete list of configured integrations. This metadata includes sensitive i…

    homarr-labs homarr
  • Medium 5.3
    CVE-2026-27797

    Homarr: Unauthenticated SSRF in rssFeed.ts

    Homarr is an open-source dashboard. Prior to version 1.54.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows a remote attacker to force the Homarr server to perform arbitrary outbound HTTP requests. This can be used as an internal n…

    homarr-labs homarr
  • Medium 5.3
    CVE-2026-25123

    Homarr affected by Unauthenticated SSRF / Port-Scan Primitive via widget.app.ping

    Homarr is an open-source dashboard. Prior to 1.52.0, a public (unauthenticated) tRPC endpoint widget.app.ping accepts an arbitrary url and performs a server-side request to that URL. This allows an unauthenticated attacker to trigger outbound HTTP requests fr…

    homarr-labs homarr