{"id":"CVE-2026-62251","kind":"vulnerability","aliases":["CVE-2026-62251","GHSA-f46q-3v67-fmm4","GO-2026-6672"],"related":[],"title":"Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app","description":"Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/sipcapture/homer-app before v0.0.0-20260625085520-a7d027dc684b.","summary":"Homer (sipcapture/homer, Go module homer-app) 11.0.281 and earlier: POST /api/v4/statistics/query passes the rawquery field to DuckDB/FlightSQL with no validation. Any authenticated user can run arbitrary SQL and read all stored SIP/call records. On deployments with an empty JWT secret, which was the default, no credentials are needed. Fixed in 11.0.283, which also removes the hardcoded default admin password and enforces JWT when the secret is empty.","severity":"high","cvss":8.1,"epss":0.00341,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/sipcapture/homer-app","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/sipcapture/homer-app","fixed":["11.0.283","v0.0.0-20260625085520-a7d027dc684b"],"affected":"<= 11.0.281 (before pseudo-version v0.0.0-20260625085520-a7d027dc684b)","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","homer","package","self-hosted","sip","sql-injection","voip"],"not_affected_if":["managed-hosting","no-homer-deployment","patched-11.0.283","unauthenticated-only-exposure"],"how_to_check":"Check the installed Homer version (homer-core --version, or the package: dpkg -l homer-core / rpm -q homer-core). 11.0.281 or older is vulnerable. Check exposure: authenticated POST to /api/v4/statistics/query is the route; see whether it is reachable from untrusted networks. Check whether coordinator.jwt.secret is empty in the config: if so, the API is effectively open.","fix":"Upgrade to Homer 11.0.283 or later. It validates rawquery (read-only SQL only), enforces JWT when the secret is empty and writes .homer_jwt_secret, and drops the default admin password 'sipcapture'. Until upgraded: set a strong coordinator.jwt.secret, change the admin password, and do not expose the API to untrusted networks. After upgrading, review the coordinator logs for the bootstrap password and jwt_secret_file.","status":"open","published_at":"2026-10-07T17:16:56+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:52:48+00:00","updated_at":"2026-10-23T21:43:37+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T19:52:48Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/sipcapture/homer-app to v0.0.0-20260625085520-a7d027dc684b or later, per the advisory's affected range.","summary":"Homer (github.com/sipcapture/homer-app), a SIP monitoring application, has an SQL injection in the /api/v4/statistics/query endpoint where the rawquery field is not validated. An authenticated user can inject SQL through that field to read or manipulate data in the backing database.","category":"package","who_cares":["go","homer","self-hosted","sip"],"confidence":0.7,"analyst_note":"Confirm the fixed version and exact affected range from https://pkg.go.dev/vuln/GO-2026-6672 and the NVD entry, and find a way to check whether deployments expose /api/v4/statistics/query.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unauthenticated-only-exposure","no-homer-deployment"],"severity_if_unknown":"high"},"cost_usd":0.000396,"input_tokens":2235,"output_tokens":344,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and exact affected range from https://pkg.go.dev/vuln/GO-2026-6672 and the NVD entry, and find a way to check whether deployments expose /api/v4/statistics/query.","search":"'-2026':16A,24A,27A '-62251':17A,28A '-6672':25A '/api/v4/statistics/query':10A,57B,123C '/sipcapture/homer-app':14A,31A,34A,176C '/sipcapture/homer-app.':127C '11.0.281':53B '11.0.283':97B '3v67':21A 'addit':136C,168C 'admin':104B 'advisori':131C 'affect':169C 'also':99B 'app':52B 'arbitrari':72B 'authent':2A,68B,115C 'automat':142C 'caus':152C 'contain':135C 'could':139C 'credenti':92B 'cve':15A,26A 'default':90B,103B 'deploy':81B 'duckdb/flightsql':63B 'earlier':55B 'edit':163C 'empti':84B,113B 'enforc':107B 'f46q':20A 'fals':154C 'false-posit':153C 'field':8A,61B,121C 'fix':95B 'fmm4':22A 'ghsa':19A 'ghsa-f46q-3v67-fmm4':18A 'github.com':13A,30A,33A,126C,175C 'github.com/sipcapture/homer-app':12A,29A,32A,174C 'github.com/sipcapture/homer-app.':125C 'go':23A,35B,48B,146C 'hardcod':102B 'homer':1A,36B,46B,51B,114C 'homer-app':50B 'host':40B 'inject':4A,44B,117C 'jwt':85B,108B 'map':143C 'modul':49B,147C,170C 'need':94B 'note':128C 'packag':37B 'pass':58B 'password':105B 'pleas':160C 'posit':155C 'post':56B 'rawqueri':7A,60B,120C 'read':75B 'record':79B 'remov':100B 'report':134C,156C,166C 'run':71B 'scanner':159C 'secret':86B,111B 'self':39B 'self-host':38B 'sip':41B 'sip/call':78B 'sipcapture/homer':47B 'sourc':130C 'sql':3A,43B,73B,116C 'sql-inject':42B 'standard':145C 'store':77B 'suggest':161C 'unvalid':6A,119C 'user':69B 'v0.0.0-20260625085520-a7d027dc684b':178C 'valid':66B 'version':137C,148C,172C 'via':5A,118C 'voip':45B 'vulner':158C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-07T17:16:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6672","url":"https://pkg.go.dev/vuln/GO-2026-6672","severity":null,"published_at":"2026-10-20T00:20:56+00:00","modified_at":"2026-10-20T00:20:56+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-62251","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-62251","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-62251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62251","severity":null,"published_at":"2026-10-07T17:16:56+00:00","modified_at":"2026-10-08T21:09:00+00:00","first_seen_at":"2026-10-23T19:14:51+00:00","fetched_at":"2026-10-23T19:14:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-62251:139","url":null,"severity":null,"published_at":"2026-10-23T21:43:37+00:00","modified_at":"2026-10-23T21:43:37+00:00","first_seen_at":"2026-10-23T21:43:37+00:00","fetched_at":"2026-10-23T21:43:37+00:00","note":"Read GHSA-f46q-3v67-fmm4 and release 11.0.283 (primary). Fixed in Homer 11.0.283 (homer-app pseudo-version a7d027dc684b); affected <= 11.0.281. Advisory has a PoC curl but no exploitation reports; no X chatter. NVD page returned nothing. Severity High, CVSS 8.1 matches the vendor. The advisory says an empty default JWT secret makes this effectively unauthenticated; the same release fixes that as GHSA-rqcc-94gv-wjm9."}],"documents":[{"id":1226,"url":"https://github.com/sipcapture/homer/security/advisories/GHSA-f46q-3v67-fmm4","title":"GHSA-f46q-3v67-fmm4 Homer authenticated SQLi","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1227,"url":"https://github.com/sipcapture/homer/releases/tag/11.0.283","title":"Homer 11.0.283 security release","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1228,"url":"https://pkg.go.dev/vuln/GO-2026-6672","title":"GO-2026-6672","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}