CVE-2026-27981

CVE-2026-27981 details a vulnerability in HomeBox, a home inventory and organization system, affecting versions prior to 0.24.0. An attacker could bypass the authentication rate limiter by forging the X-Real-IP header, effectively creating a new identity for each failed login attempt. This allows for unlimited brute-force attacks against user credentials. The vulnerability has a CVSS score of 7.4 (HIGH), indicating a network-based attack with high impact on confidentiality and integrity, but requiring high attack complexity. Although the system is susceptible to brute-force attacks, the high complexity suggests it might not be trivial to execute. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The CVE has received minimal community discussion and media coverage, suggesting it is not widely known or actively targeted.