CVE-2026-48976 in HomeBox
Summary
by MITRE • 09/21/2026
HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go updates a notifier through UpdateOneID(id) without requiring the record's user ID to match the authenticated user. An authenticated user who supplies another tenant's notifier UUID to PUT /v1/notifiers/{id} can read the returned stored url, which may contain plaintext Shoutrrr credentials for Slack, SMTP, Telegram, Pushover, or Discord, and can replace the URL to redirect the victim's notifications to an attacker-controlled webhook. This issue is fixed in version 0.26.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in HomeBox versions prior to 0.26.0 represents a critical failure in access control mechanisms, specifically classified under CWE-862 as Missing Authorization and CWE-915 as Improperly Controlled Modification of Dynamically-Determined Object Attributes. This flaw resides within the backend implementation of the application's notification system, particularly affecting the NotifierRepository.Update function located in repo_notifier.go. The core technical deficiency is that the UpdateOneID method performs database updates based solely on the provided identifier without validating whether the authenticated user initiating the request owns or has permission to modify the specific notifier record associated with that identifier. This lack of tenant isolation allows an attacker who possesses valid authentication credentials for one account to interact with resources belonging to other tenants within the same instance, effectively bypassing multi-tenant security boundaries.
The operational impact of this vulnerability is severe due to the sensitive nature of the data involved and the potential for malicious exploitation. When a user submits a PUT request to /v1/notifiers/{id} using another tenant's notifier UUID, the system not only allows modification but also returns the updated object in the response body. This behavior inadvertently exposes stored configuration details, including plaintext Shoutrrr credentials used by various notification services such as Slack, SMTP servers, Telegram bots, Pushover applications, and Discord webhooks. An attacker can exploit this information disclosure to harvest sensitive authentication tokens or server connection strings, which may be reused in other attacks if the user has employed credential reuse practices across different platforms.
Beyond simple data exfiltration, the vulnerability enables a more active form of attack known as notification hijacking or webhook redirection. By replacing the notifier URL with one controlled by the attacker, an adversary can intercept all outgoing notifications intended for the victim. This capability allows the attacker to monitor sensitive alerts regarding home inventory changes, security events, or system status updates that are sent via these channels. Furthermore, if the application sends automated warnings or critical alerts through these compromised notifiers, the attacker could potentially disrupt operational continuity by redirecting them away from legitimate recipients or flooding the victim's account with spam messages using their own configured services, thereby causing denial of service or reputational damage to the victim within those external communication platforms.
From a threat modeling perspective aligned with MITRE ATT&CK techniques, this vulnerability facilitates Initial Access through credential harvesting if reused credentials are discovered and enables Lateral Movement by leveraging stolen tokens from integrated services like Slack or Discord to access other organizational resources. It also aligns with Data Exfiltration over C2 channels when the attacker uses their own webhook to receive sensitive data sent via the compromised notifier, effectively turning the victim's notification system into a covert communication channel for exfiltrating information about the home inventory and organization structure.
To mitigate this vulnerability, immediate action is required by upgrading HomeBox to version 0.26.0 or later, where the issue has been resolved through proper implementation of ownership checks within the repository layer. In environments where an upgrade is not immediately feasible, administrators should implement strict input validation at the reverse proxy or API gateway level to ensure that resource IDs in PUT requests correspond only to resources owned by the authenticated user session. Additionally, it is crucial to audit existing notifier configurations for any signs of tampering and rotate all exposed credentials for Slack, SMTP, Telegram, Pushover, and Discord services immediately. Future development should enforce principle of least privilege by ensuring that API responses do not return sensitive configuration details such as plaintext URLs containing secrets unless explicitly required and properly sanitized, thereby reducing the blast radius in case of future access control failures.