CVE-2026-27796CWE-200CWE-862

Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak)

Medium · published March 7, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
67.3
In the wild
Unconfirmed
What it is

Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is exposed as a publicProcedure, allowing unauthenticated users to retrieve a complete list of configured integrations. This metadata includes sensitive information such as internal service URLs, integration names, and service types. This issue has been patched in version 1.54.0.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01175 · 67.3th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-862 · Missing Authorization
Published
2026-03-07T05:54Z
EPSS history
Timeline
  • 07 MAR 05:54Z
    Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak)
    cvelistv5