CVE-2026-48976 HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack

HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/reponotifier.go updates a notifier through UpdateOneIDid without requiring the record's user ID to match the authenticated user. An authenticated user who supplies another...

PT-2026-96186

Name of the Vulnerable Software and Affected Versions HomeBox versions prior to 0.26.0 Description An authenticated user can update a notifier belonging to another tenant by providing the target notifier UUID to the 'PUT /v1/notifiers/id' endpoint. This occurs because the NotifierRepository.Updat...