Access Control Flaw in HomeBox Home Inventory System
CVE-2026-48976
What is CVE-2026-48976?
HomeBox, a home inventory and organization system, suffers from an access control flaw that allows authenticated users to potentially access and manipulate another tenant's notifier data. Specifically, prior to version 0.26.0, users could submit a request to update a notifier without ensuring that the requested notifier ID belonged to them. This oversight could result in the exposure of sensitive URLs, which might contain plaintext credentials for various communication services such as Slack, SMTP, Telegram, Pushover, or Discord. Moreover, an attacker could redirect notifications to a compromised webhook, posing significant risks to user data integrity and confidentiality. This vulnerability has been addressed in version 0.26.0.
Affected Version(s)
homebox < 0.26.0