1.2 KiB
homepage — triage (group C, 2026-10-27)
Pin: ghcr.io/gethomepage/homepage:v1.13.2. family_gate: true (only signed-in household members reach it). No app login. Starts with sample config; no credentialed service widgets configured by Felhom; Docker socket removed (R-981).
Notices (1)
- GHSA-669x-4pg4-w24r (medium, CVSS I:L, no auth): REAL (
< 2.2.0). /api/services/proxy lets the caller pick method/body sent to a configured widget's upstream with the widget's stored credentials. Reachable only by a household member behind the family gate, and only if the household hand-wrote a credentialed widget.
Fix
Smallest: v2.2.0 (release note "Resolve GHSA-669x-4pg4-w24r"). No 1.x after v1.13.2. TARGET: v2.7.0 (ghcr tags v2.2.0, v2.7.0 exist). Same main: NO. Breaking (read v2.0.0..v2.7.0, 10 releases): v2.0.0 "Breaking: homepage auth" (#6769; the advisory PoC runs with HOMEPAGE_AUTH_ENABLED unset, so it looks opt-in — unsure, bench it with HOMEPAGE_ALLOWED_HOSTS); v2.6.0 auth architecture refactor + GHSA-qxcr-4rv3-v23r; v2.7.0 base image node 24, nextjs middleware -> proxy; v2.1.1 YAML parse bug (fixed 2.1.2). Lane: BIG_STEP (low urgency: family gate).
Classifier note
none