CVE-2026-48976

HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go updates a notifier through UpdateOneID(id) without requiring the record's user ID to match the authenticated user. An authenticated user who supplies another tenant's notifier UUID to PUT /v1/notifiers/{id} can read the returned stored url, which may contain plaintext Shoutrrr credentials for Slack, SMTP, Telegram, Pushover, or Discord, and can replace the URL to redirect the victim's notifications to an attacker-controlled webhook. This issue is fixed in version 0.26.0.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/sysadminsmedia/homebox/commit/ed3216a80998dfd81d4418700696244144883160
https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0
https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-mc8h-5c5v-37p7

Configurations

No configuration.

History

21 Sep 2026, 18:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-21 18:17

Updated : 2026-09-23 18:26

NVD link : CVE-2026-48976

Mitre link : CVE-2026-48976

CVE.ORG link : CVE-2026-48976

JSON object : View

Products Affected

No product.

CWE

CWE-522

Insufficiently Protected Credentials

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-48976", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48976", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-21T17:50:15.872305Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "sysadminsmedia", "product": "homebox", "versions": [{"status": "affected", "version": "< 0.26.0"}]}]}], "published": "2026-09-21T18:17:08.557", "references": [{"url": "https://github.com/sysadminsmedia/homebox/commit/ed3216a80998dfd81d4418700696244144883160", "source": "security-advisories@github.com"}, {"url": "https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-mc8h-5c5v-37p7", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-522"}, {"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go updates a notifier through UpdateOneID(id) without requiring the record's user ID to match the authenticated user. An authenticated user who supplies another tenant's notifier UUID to PUT /v1/notifiers/{id} can read the returned stored url, which may contain plaintext Shoutrrr credentials for Slack, SMTP, Telegram, Pushover, or Discord, and can replace the URL to redirect the victim's notifications to an attacker-controlled webhook. This issue is fixed in version 0.26.0."}], "lastModified": "2026-09-23T18:26:49.087", "sourceIdentifier": "security-advisories@github.com"}