The notifier validation in HomeBox fails to examine IPv4 addresses that are embedded within the NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48. When an authenticated user submits a generic:// notifier, the gateway can convert the IPv6 destination to an internal IPv4 endpoint such as the cloud metadata service, localhost, or other private hosts. The POST endpoints /v1/notifiers and /v1/notifiers/test then return delivery results, allowing Shoutrrr to expose the fetched data. Consequently, an attacker can obtain temporary credentials or sensitive internal information, representing a data confidentiality breach.

All HomeBox installations from versions earlier than 0.26.0 that are configured to egress via NAT64/DNS64 are impacted. The vulnerability exists within the default-on BlockBogonNets and BlockCloudMetadata SSRF checks located in backend/internal/sys/validate/notifier_url.go. Any user who can authenticate and issue POST requests to the notifier endpoints can exploit the flaw.

The CVSS score of 6 indicates a medium severity. The EPSS score is not available, so the likelihood of exploitation is presently unknown. HomeBox is not listed in the CISA KEV catalog. An attacker needs network access to the instance, an authenticated session, and the ability to submit a notifier; under those conditions the vulnerability can be exercised remotely.