Executive brief
HomeBox is a home inventory management application that allows users to configure notification services like Slack, SMTP, and Telegram. A flaw in versions before 0.26.0 allows any authenticated user to access and modify another tenant's notification settings, potentially exposing plaintext credential URLs and redirecting notifications to attacker-controlled servers. An attacker can read stored credentials and hijack the victim's notifications.
Technical details
The NotifierRepository.Update function in backend/internal/data/repo/repo_notifier.go performs UpdateOneID(id) without validating that the notifier's user ID matches the authenticated user making the request. An authenticated attacker can supply another tenant's notifier UUID to the PUT /v1/notifiers/{id} endpoint to read and modify arbitrary notifier configurations, exposing Shoutrrr credential URLs that may contain plaintext secrets for Slack, SMTP, Telegram, Pushover, or Discord. The fix is available in version 0.26.0.
Affected products
- sysadminsmedia HomeBox before 0.26.0
Timeline
- 2026-09-21: disclosed
- 2026-06-13: patched: Fixed in version 0.26.0