VulnSocial

CVE-2026-48976Disclosure

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go updates a notifier through UpdateOneID(id) without requiring the record's user ID to match the authenticated user. An authenticated user who supplies another tenant's notifier UUID to PUT /v1/notifiers/{id} can read the returned stored url, which may contain plaintext Shoutrrr credentials for Slack, SMTP, Telegram, Pushover, or Discord, and can replace the URL to redirect the victim's notifications to an attacker-controlled webhook. This issue is fixed in version 0.26.0.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-522CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-21); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-21: 1Mentions · 2026-10-17: 1Patch / Workaround · 2026-10-17: 1Technical Details · 2026-09-21: 1Technical Details · 2026-10-17: 109-2110-17
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-211
Disclosure1
2026-10-171
Patch1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-48976 HomeBox: authenticated users can hijack another tenant's notifier via PUT /v1/notifiers/{id}, leaking plaintext Shoutrrr creds (Slack, SMTP, Telegram, Discord). CVSS 8.1. Patch under review - isolate https://www.valtersit.com/cve/CVE-2026-48976 #CVE #infosec #cybersecurity #HomeBox #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The text discloses CVE-2026-48976 in HomeBox — an authenticated tenant hijack via PUT /v1/notifiers/{id} leaking plaintext credentials (CVSS 8.1) — and notes a patch under review along with a recommended isolation workaround.

    0000054
    1.1K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-48976 HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go updates a notifier thro… https://www.cve.org/CVERecord?id=CVE-2026-48976

    Post summary

    The tweet discloses technical details for CVE-2026-48976 affecting HomeBox, specifying the vulnerable code path and version, but does not indicate active exploitation, available patches, or exploit code.

    00000818
    58.1K followersView on X

Explore more

Back to dashboard