HomeBox, a home inventory system, validates generic notifier URLs before creating or updating them, but the shoutrrr library follows HTTP redirects without revalidating the target. This oversight allows an authenticated collection member to set a notifier that redirects to loopback, link‑local, cloud metadata, or other disallowed destinations, thereby bypassing the product’s SSRF controls and causing the server to send requests to internal or external resources it should not access.

The vulnerability affects sysadminsmedia HomeBox installations running any version older than 0.27.0, as only v0.27.0 and later include the fix that revalidates redirect targets during notifier delivery.

The flaw carries a CVSS score of 6.4 and is not listed in CISA’s KEV catalog; EPSS data is not available, indicating no publicly confirmed exploitation yet. An attacker with authenticated access to a collection member can trigger the vulnerability through the test API endpoint or scheduled notifier runs, enabling internal server requests or leakage of sensitive resources depending on the redirect target. The risk is moderate, but the absence of broader exploitation reports suggests the threat may remain largely undetected within compromised installations.