CVE-2026-48976
Received Received - Intake

Information Disclosure in HomeBox via Notifier URL Manipulation

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go updates a notifier through UpdateOneID(id) without requiring the record's user ID to match the authenticated user. An authenticated user who supplies another tenant's notifier UUID to PUT /v1/notifiers/{id} can read the returned stored url, which may contain plaintext Shoutrrr credentials for Slack, SMTP, Telegram, Pushover, or Discord, and can replace the URL to redirect the victim's notifications to an attacker-controlled webhook. This issue is fixed in version 0.26.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-48976
EUVD
EUVD-2026-84033

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
homebox home_inventory_and_organization_system to 0.26.0 (exc)
sysadminsmedia homebox to 0.26.0 (exc)
sysadminsmedia homebox 0.26.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48976 is an Insecure Direct Object Reference (IDOR) vulnerability in HomeBox versions 0.25.0 and earlier. It allows authenticated users to access or modify another user's notifier settings without proper authorization. The vulnerability exists in the Notifier Update functionality where the system fails to enforce user-specific scoping during updates.

Detection Guidance

To detect this vulnerability, check if your HomeBox instance is running version 0.25.0 or earlier. Inspect network traffic for PUT requests to /v1/notifiers/{id} that return plaintext credentials in the response. Review logs for unauthorized access attempts to notifier endpoints.

Impact Analysis

This vulnerability can lead to two main impacts. First, an attacker could read another user's stored Shoutrrr URL, which contains plaintext credentials for services like Slack, SMTP, Telegram, Pushover, or Discord. Second, the attacker could change the URL to redirect the victim's notifications to a server they control, potentially intercepting sensitive information.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection standards like GDPR and HIPAA due to unauthorized access to credentials and potential exposure of sensitive user data. It compromises confidentiality and integrity of personal and health-related information.

Mitigation Strategies

Immediately upgrade HomeBox to version 0.26.0 or later. Review and rotate all credentials stored in notifier configurations. Audit access logs for suspicious activity related to notifier endpoints. Implement network-level controls to restrict access to /v1/notifiers/{id} endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48976. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart