---
id: CVE-2026-48976
title: HomeBox is a home inventory and organization system
summary: >-
  HomeBox is a home inventory and organization system. Prior to 0.26.0,
  NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go
  updates a notifier through UpdateOneID(id) without requiring the record's user
  ID to match the…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-522
  - CWE-639
vendor: sysadminsmedia
product: homebox
affected:
  - homebox < 0.26.0
published: '2026-09-21'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T18:17:08.557'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48976'
references:
  - url: >-
      https://github.com/sysadminsmedia/homebox/commit/ed3216a80998dfd81d4418700696244144883160
    label: security-advisories@github.com
  - url: 'https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-mc8h-5c5v-37p7
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-21T17:50:15.872305Z'
ingestedAt: '2026-09-21T17:49:53.178Z'
---

## Overview

HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go updates a notifier through UpdateOneID(id) without requiring the record's user ID to match the authenticated user. An authenticated user who supplies another tenant's notifier UUID to PUT /v1/notifiers/{id} can read the returned stored url, which may contain plaintext Shoutrrr credentials for Slack, SMTP, Telegram, Pushover, or Discord, and can replace the URL to redirect the victim's notifications to an attacker-controlled webhook. This issue is fixed in version 0.26.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.