Junglewise Threat Intelligence

CVE-2026-48976: HomeBox notifier cross-tenant access and credential exposure

CVE-2026-48976 · Severity: high · CVSS 8.1 · Published 2026-09-21

Technologies: Sysadminsmedia HomeBox. Vendors: Sysadminsmedia.

Executive brief

HomeBox is a home inventory management application that allows users to configure notification services like Slack, SMTP, and Telegram. A flaw in versions before 0.26.0 allows any authenticated user to access and modify another tenant's notification settings, potentially exposing plaintext credential URLs and redirecting notifications to attacker-controlled servers. An attacker can read stored credentials and hijack the victim's notifications.

Technical details

The NotifierRepository.Update function in backend/internal/data/repo/repo_notifier.go performs UpdateOneID(id) without validating that the notifier's user ID matches the authenticated user making the request. An authenticated attacker can supply another tenant's notifier UUID to the PUT /v1/notifiers/{id} endpoint to read and modify arbitrary notifier configurations, exposing Shoutrrr credential URLs that may contain plaintext secrets for Slack, SMTP, Telegram, Pushover, or Discord. The fix is available in version 0.26.0.

Affected products

  • sysadminsmedia HomeBox before 0.26.0

Timeline

  • 2026-09-21: disclosed
  • 2026-06-13: patched: Fixed in version 0.26.0

References

Related threats