3.1 KiB
3.1 KiB
homebox — triage (pin ghcr.io/sysadminsmedia/homebox:0.26.2, single image, SQLite)
Template: setup_gate: true, signup_block on /api/v1/users/register, HBOX_OPTIONS_ALLOW_REGISTRATION off after setup.
No notifier configured by default. One group per household normally.
Notices (13 GHSA + 2 release hits) — all GHSA ranges include 0.26.2 (fixed 0.27.0; v0.27.0 body lists them)
| id | sev | verdict | login | reachable |
|---|---|---|---|---|
| GHSA-jm28-2xm3-m6m5 | high | REAL: any group member can rename/delete/take over the group (cascade-deletes inventory) | any user | yes |
| GHSA-58m4-m8xj-v3j2 | high | REAL: unauth register endpoint, no rate limit, Argon2id per request (DoS) | none | NO — register path refused by signup_block (setup_gate before) |
| GHSA-xqg9-6xxv-3452 | medium | REAL: case-variant e-mail duplicate account -> victim login DoS (via register) | none | NO — signup_block |
| GHSA-mw9p-fhpj-jf82 | medium | REAL: invitation quota race (via register) | invite token | NO — signup_block |
| GHSA-754m-5j7m-8wfv | medium | REAL: X-Forwarded-Host into /swagger/doc.json | none | yes (impact needs a shared cache) |
| GHSA-4p8r-vm9v-c9pm | low | REAL: login timing user enumeration | none | yes |
| GHSA-rhfm-x4x2-p3qr | medium | REAL: generic:// notifier SSRF to localhost/RFC1918 (household LAN, box docker net) | any user | yes |
| GHSA-4gp5-59x3-vhhg | medium | REAL: notifier SSRF via redirect | any user | yes |
| GHSA-h7wm-wjr6-cfxh | medium | REAL: CSV formula injection in exports | any user | yes |
| GHSA-59cq-p2m6-hh23 | medium | REAL: API keys survive password change, no expiry | stolen key | yes |
| GHSA-g3p9-jfjj-pqgw | low | REAL: no revoke-other-sessions | stolen token | yes |
| GHSA-j935-m3f2-frrj | medium | REAL: cross-group custom-field mutation | any user | only with 2+ groups (unusual on a box) |
| GHSA-wxcf-4p4j-vhvg | medium | REAL: cross-group entity read via PUT | any user | only with 2+ groups |
| release:v0.27.0 | - | REAL: the security release carrying the GHSAs above | - | - |
| release:v0.27.1 | - | NOT-A-FINDING for the runtime: Node2Shell patch, but Dockerfile@v0.27.1 uses node:22-alpine only in build stages; final image is alpine + Go binary (no Node at runtime) | - | - |
| Real 14 / 15. Worst reachable: high (jm28, any user). Worst unauth (58m4) is blocked by our signup_block. |
Fix
Smallest: 0.27.0. TARGET ghcr.io/sysadminsmedia/homebox:0.27.1 (newest stable; ghcr manifest 0.27.1 and 0.27.0 exist — no v prefix, matching our pin). Same main (0): yes.
Breaking/migrations 0.26.2 -> 0.27.1 (read v0.27.0-rc.1, v0.27.0, v0.27.1):
- CAUTION 0.27.0: notifiers now BLOCK internal IPs by default — a household notifier pointed at a LAN/RFC1918 address stops working (that is the SSRF fix itself). Behaviour change, not data/config conversion.
- "better search" (tokenized DB search, optional Meilisearch) — app-run DB change; Meilisearch optional.
- No env rename, no file layout change, no new required service found. Lane: SECURITY_FIX (one caveat: internal-IP notifier block). Classifier note: release:v0.27.1 is a build-toolchain (Node) patch; Homebox ships no Node at runtime — should not count as an app/runtime fix.