High severity · published Sep 21, 2026
CVE-2026-48976
HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack
8.1
CVSS
0.4%
EPSS
No
On KEV
Description
HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go updates a notifier through UpdateOneID(id) without requiring the record's user ID to match the authenticated user. An authenticated user who supplies another tenant's notifier UUID to PUT /v1/notifiers/{id} can read the returned stored url, which may contain plaintext Shoutrrr credentials for Slack, SMTP, Telegram, Pushover, or Discord, and can replace the URL to redirect the victim's notifications to an attacker-controlled webhook. This issue is fixed in version 0.26.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HO
homebox · sysadminsmedia
< 0.26.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-48976
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-48976
github.com
https://github.com/sysadminsmedia/homebox/commit/ed3216a80998dfd81d4418700696244144883160
github.com
https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0
github.com
https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-mc8h-5c5v-37p7
More from homebox
8.1
CVE-2026-48826
HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching
8.1
CVE-2026-48975
HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox
8.1
CVE-2026-40196
HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation
7.4
CVE-2026-27981
HomeBox has an Auth Rate Limit Bypass via IP Spoofing
6.4
CVE-2026-116680
Homebox generic notifier SSRF via HTTP redirect after URL validation