CVE-2026-48976: HomeBox Auth Bypass Vulnerability

CVE-2026-48976 Overview

HomeBox, a self-hosted home inventory and organization system, contains a broken access control vulnerability in versions prior to 0.26.0. The NotifierRepository.Update function in backend/internal/data/repo/repo_notifier.go updates a notifier using UpdateOneID(id) without verifying that the record's owner matches the authenticated user. An authenticated attacker who supplies another tenant's notifier UUID to PUT /v1/notifiers/{id} can read stored Shoutrrr URLs and replace them with attacker-controlled endpoints. The issue is tracked under [CWE-522: Insufficiently Protected Credentials] and is resolved in HomeBox 0.26.0.

Critical Impact

Authenticated tenants can steal plaintext Shoutrrr credentials for Slack, SMTP, Telegram, Pushover, or Discord belonging to other tenants, and redirect victims' notifications to attacker-controlled webhooks.

Affected Products

• HomeBox versions prior to 0.26.0
• backend/internal/data/repo/repo_notifier.go — NotifierRepository.Update
• PUT /v1/notifiers/{id} API endpoint

Discovery Timeline

• 2026-09-21 - CVE-2026-48976 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-48976

Vulnerability Analysis

The vulnerability is a horizontal privilege escalation via Insecure Direct Object Reference (IDOR) in the HomeBox notifier update flow. HomeBox uses Shoutrrr URLs to deliver notifications to services such as Slack, SMTP, Telegram, Pushover, and Discord. These URLs typically embed plaintext credentials — bot tokens, SMTP passwords, or webhook secrets.

When a user issues PUT /v1/notifiers/{id}, the backend calls NotifierRepository.Update, which invokes UpdateOneID(id) on the ent client. The query filters only on the notifier UUID and ignores the authenticated user's ID. Any authenticated user can therefore target any notifier record in the database. The response returns the stored URL, enabling credential theft, and the write path allows silent replacement of the URL to redirect notifications.

Root Cause

The root cause is a missing ownership check in the repository layer. The update query should have been scoped with a Where(notifier.UserID(authUserID)) predicate before executing UpdateOneID. Instead, authorization was assumed at a higher layer that only validated authentication, not resource ownership. This falls under [CWE-522] because credentials embedded in Shoutrrr URLs were not adequately protected from cross-tenant reads.

Attack Vector

Exploitation requires only a valid authenticated session on the HomeBox instance and knowledge or enumeration of a target notifier UUID. The attacker sends a PUT /v1/notifiers/{id} request with the victim's notifier ID and any body. The server returns the stored URL — including plaintext Shoutrrr credentials — and persists any URL the attacker provides, redirecting future notifications.

// Patch context from the HomeBox 0.26.0 release — ownership enforcement pattern
// Source: https://github.com/sysadminsmedia/homebox/commit/ed3216a80998dfd81d4418700696244144883160

ctx := services.NewContext(r.Context())

// Before: relied on a cached ctx.User.IsOwner flag
// After: authoritative ownership check against the repository
isOwner, err := ctrl.repo.Groups.IsOwnerOf(ctx, ctx.UID, ctx.GID)
if err != nil {
    return validate.NewRequestError(err, http.StatusInternalServerError)
}
if !isOwner {
    return validate.NewRequestError(errors.New("only group owners can wipe inventory"), http.StatusForbidden)
}

The patch illustrates the broader remediation pattern applied across HomeBox in 0.26.0: replace implicit trust in session-carried flags with explicit, repository-scoped ownership checks. The equivalent fix in NotifierRepository.Update scopes the update to the authenticated user's ID.

Detection Methods for CVE-2026-48976

Indicators of Compromise

• PUT /v1/notifiers/{id} requests where the target notifier UUID does not belong to the authenticated session user.
• Unexpected changes to Shoutrrr URLs in the notifiers table, particularly host or token changes on Slack, Discord, Telegram, SMTP, or Pushover entries.
• Notification deliveries reaching unknown external webhook domains outside the organization's approved integrations.
• Access log spikes showing enumeration of /v1/notifiers/ endpoints from a single session.

Detection Strategies

• Correlate application access logs with database audit logs to flag notifier updates where the authenticated user_id does not match the notifier's owning user_id.
• Alert on any 2xx response to PUT /v1/notifiers/{id} initiated by a user account that did not previously perform a GET or POST on the same notifier ID.
• Baseline outbound notification destinations and alert on new destination hosts introduced via the notifier API.

Monitoring Recommendations

• Enable verbose HTTP access logging on the HomeBox reverse proxy and forward it to a centralized log platform for retention and correlation.
• Monitor outbound egress from the HomeBox host for connections to previously unseen Slack, Discord, Telegram, or SMTP endpoints.
• Track version metadata to ensure all HomeBox deployments report 0.26.0 or later after remediation.

How to Mitigate CVE-2026-48976

Immediate Actions Required

• Upgrade HomeBox to version 0.26.0 or later as published in the GitHub Release v0.26.0.
• Rotate every credential embedded in existing Shoutrrr notifier URLs, including Slack bot tokens, SMTP passwords, Telegram bot tokens, Pushover keys, and Discord webhook secrets.
• Audit the notifiers table for URLs pointing to unexpected destinations and remove or restore them to known-good values.
• Review authentication and invitation logs to identify any recently added tenants that may have exploited the flaw before patching.

Patch Information

The fix is delivered in commit ed3216a8 and released in HomeBox 0.26.0. Full remediation details are documented in GitHub Security Advisory GHSA-mc8h-5c5v-37p7. The patch enforces ownership checks in the repository layer so that notifier updates are scoped to the authenticated user.

Workarounds

• If immediate patching is not possible, restrict access to the HomeBox instance to trusted single-tenant use only and disable open registration.
• Place the notifier API behind a reverse proxy rule that denies PUT /v1/notifiers/{id} for non-administrator sessions until the upgrade is complete.
• Temporarily remove sensitive Shoutrrr notifiers and replace them with proxy webhooks that do not expose upstream credentials.

# Example: block PUT /v1/notifiers/{id} at nginx until HomeBox is upgraded to 0.26.0
location ~ ^/v1/notifiers/[0-9a-fA-F-]+$ {
    if ($request_method = PUT) {
        return 403;
    }
    proxy_pass http://homebox_backend;
}