CVE-2026-48976

HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go updates a notifier through UpdateOneID(id) without requiring the record's user ID to match the authenticated user. An authenticated user who supplies another tenant's notifier UUID to PUT /v1/notifiers/{id} can read the returned stored url, which may contain plaintext Shoutrrr credentials for Slack, SMTP, Telegram, Pushover, or Discord, and can replace the URL to redirect the victim's notifications to an attacker-controlled webhook. This issue is fixed in version 0.26.0.

• CWE-522
• CWE-639

• https://github.com/sysadminsmedia/homebox/commit/ed3216a80998dfd81d4418700696244144883160
• https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0
• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-mc8h-5c5v-37p7

Published

Sep 21, 2026

Last Modified

Sep 23, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48970Unauthenticated Broken Authentication in Really Simple SSL <…8.1
• CVE-2026-48971Missing Authorization vulnerability in WebToffee Product Imp…4.3
• CVE-2026-48972Improper Control of Filename for Include/Require Statement i…7.5
• CVE-2026-48973Missing Authorization vulnerability in Benbodhi SVG Support …4.3
• CVE-2026-48974HomeBox is a home inventory and organization system. Prior t…5.4
• CVE-2026-48975HomeBox is a home inventory and organization system. Prior t…8.1
• CVE-2026-48977OpenSlide is a C library for reading whole slide image files…7.7
• CVE-2026-48978oras-go is a Go library for managing OCI artifacts. Prior to…2.1
• CVE-2026-48979PHP Standard Library (PSL) is set of APIs covering async, co…7.5
• CVE-2026-4898A vulnerability was identified in code-projects Online Food …4.3
• CVE-2026-48980pam_usb provides hardware authentication for Linux using rem…6.3
• CVE-2026-48981pam_usb provides hardware authentication for Linux using ord…6.7