Answer in brief
CVE-2026-48976 records a High severity (CVSS 8.1) vulnerability in HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack. The current sources do not mark it as known exploited. The current feed maps sysadminsmedia/homebox (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps sysadminsmedia/homebox (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| sysadminsmedia/homeboxgeneric | <0.26.0 | 0.26.0 |
Published upstream
Sep 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 21, 2026
HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go updates a notifier through UpdateOneID(id) without requiring the record's user ID to match the authenticated user. An authenticated user who supplies another tenant's notifier UUID to PUT /v1/notifiers/{id} can read the returned stored url, which may contain plaintext Shoutrrr credentials for Slack, SMTP, Telegram, Pushover, or Discord, and can replace the URL to redirect the victim's notifications to an attacker-controlled webhook. This issue is fixed in version 0.26.0.
Quoted source text, attributed separately from HOL analysis.