{"id":"CVE-2026-48976","published":"2026-09-21T18:17:08.557","lastModified":"2026-09-23T18:26:49.087","description":"HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go updates a notifier through UpdateOneID(id) without requiring the record's user ID to match the authenticated user. An authenticated user who supplies another tenant's notifier UUID to PUT /v1/notifiers/{id} can read the returned stored url, which may contain plaintext Shoutrrr credentials for Slack, SMTP, Telegram, Pushover, or Discord, and can replace the URL to redirect the victim's notifications to an attacker-controlled webhook. This issue is fixed in version 0.26.0.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-522","CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://github.com/sysadminsmedia/homebox/commit/ed3216a80998dfd81d4418700696244144883160","tags":[]},{"url":"https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0","tags":[]},{"url":"https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-mc8h-5c5v-37p7","tags":[]}],"exploitRefs":[{"url":"https://github.com/sysadminsmedia/homebox/commit/ed3216a80998dfd81d4418700696244144883160","tags":[]},{"url":"https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0","tags":[]},{"url":"https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-mc8h-5c5v-37p7","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows an authenticated user to read and potentially modify notifiers belonging to other tenants, exposing sensitive credentials and redirecting notifications to attacker-controlled webhooks.","exploitability":"Exploitation requires an authenticated user with access to another tenant's notifiers. The attacker must supply a valid UUID for the target notifier.","blast_radius":"If exploited, the impact could be severe, as it allows the attacker to gain access to sensitive credentials and redirect notifications, potentially leading to data exfiltration or loss of service.","remediation":"Upgrade to version 0.26.0 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","data-exposure"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-03T09:05:58.293Z"}}