CVE-2026-48976

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48976
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48976.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48976
Aliases
  • GHSA-mc8h-5c5v-37p7
Published
2026-09-21T17:41:16Z
Modified
2026-09-25T03:30:37Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack
Details

HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go updates a notifier through UpdateOneID(id) without requiring the record's user ID to match the authenticated user. An authenticated user who supplies another tenant's notifier UUID to PUT /v1/notifiers/{id} can read the returned stored url, which may contain plaintext Shoutrrr credentials for Slack, SMTP, Telegram, Pushover, or Discord, and can replace the URL to redirect the victim's notifications to an attacker-controlled webhook. This issue is fixed in version 0.26.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-522",
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48976.json"
}
References

Affected packages

Git / github.com/sysadminsmedia/homebox

Affected ranges

Type
GIT
Repo
https://github.com/sysadminsmedia/homebox
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ed3216a80998dfd81d4418700696244144883160
Fixed
c0bcd3b4682fce0fb512cb191ea754d725e416ee
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.26.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.0
v0.11.0
v0.11.1
v0.12.0
v0.12.1
v0.13.0
v0.14.0
v0.14.1
v0.14.2
v0.15.0
v0.15.1
v0.15.2
v0.16.0
v0.17.0
v0.17.1
v0.17.2
v0.18.0
v0.19.0
v0.2.0
v0.20.1
v0.20.2
v0.21.0
v0.22.0-rc.1
v0.22.1
v0.22.2
v0.22.3
v0.23.0
v0.23.0-rc.1
v0.23.1
v0.24.0
v0.24.0-rc.1
v0.24.1
v0.24.2
v0.25.0
v0.25.0-rc.1
v0.26.0-rc.1
v0.3.0
v0.3.1
v0.4.0
v0.5.0
v0.5.1
v0.6.0
v0.7.0
v0.8.0
v0.8.1
v0.8.2
v0.9.0
v0.9.1
v0.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48976.json"