The Homarr dashboard allowed any unauthenticated user to query the widget.app.ping tRPC endpoint with an arbitrary URL. The server then performed an outbound HTTP request to that URL, providing the attacker with the ability to direct all outbound traffic from the Homarr instance. This results in SSRF, enabling the attacker to reach internal or restricted resources, and a reliable port‑scanning primitive through response status codes and fetch failures. The vulnerability could lead to information disclosure, network reconnaissance, or further exploitation of reachable services, with limited privileges confined to the host running Homarr.

This issue impacts Homarr dashboards running any version before 1.52.0. All installations of homarr-labs:homarr that have not been upgraded to at least 1.52.0 are susceptible.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is reported as <1%, suggesting a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can reach the widget.app.ping endpoint without authentication, likely exposing it through a public network or internal network where the Homarr instance is reachable. Once accessed, the attacker supplies a crafted URL, triggering an outbound request from the server. The method of discerning open or closed ports via status code or timing implies that the attack can be performed programmatically for reconnaissance or other malicious objectives.