CVE-2026-48976: HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack
HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/reponotifier.go updates a notifier through UpdateOneID(id) without requiring the record's user ID to match the authenticated user. An authenticated user who supplies another tenant's notifier UUID to PUT /v1/notifiers/{id} can read the returned stored url, which may contain plaintext Shoutrrr credentials for Slack, SMTP, Telegram, Pushover, or Discord, and can replace the URL to redirect the victim's notifications to an attacker-controlled webhook. This issue is fixed in version 0.26.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HomeBoxto a version that resolves this vulnerability.Fixed in 0.26.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated HomeBox user can exploit it if they know or can supply another tenant's notifier UUID. No additional privileges or user interaction are required.
Which notifier data and behavior are exposed?
The update response can disclose the stored notifier URL, including plaintext Shoutrrr credentials for Slack, SMTP, Telegram, Pushover, or Discord. An attacker can also replace that URL, redirecting the victim's notifications to an attacker-controlled webhook.
Which versions are affected and what is the fix?
Versions prior to 0.26.0 are affected. Upgrade HomeBox to version 0.26.0, which fixes the missing user-ownership check during notifier updates.