Live › vulnerability › CVE-2026-62251
Go to dashboardHomer (sipcapture/homer, Go module homer-app) 11.0.281 and earlier: POST /api/v4/statistics/query passes the rawquery field to DuckDB/FlightSQL with no validation. Any authenticated user can run arbitrary SQL and read all stored SIP/call records. On deployments with an empty JWT secret, which was the default, no credentials are needed. Fixed in 11.0.283, which also removes the hardcoded default admin password and enforces JWT when the secret is empty.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/sipcapture/homer-app | go | all versions | – |
| github.com/sipcapture/homer-app | go | <= 11.0.281 (before pseudo-version v0.0.0-20260625085520-a7d027dc684b) | 11.0.283, v0.0.0-20260625085520-a7d027dc684b |
dpkg -l homer-core / rpm -q homer-core 11.0.281 or older is vulnerable11.0.283 or latersipcaptureEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/sipcapture/homer-app before v0.0.0-20260625085520-a7d027dc684b.
This page as .md · .json · in your agent: get_signal("CVE-2026-62251")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.