HomeBox CVE-2026-48976

Requires an authenticated low-privilege account on a HomeBox instance (PR:L) that is multi-tenant/multi-user - single-user deployments have no other tenant to target. The attacker must additionally know or obtain a specific foreign notifier's UUID, since PUT /v1/notifiers/{id} is keyed by that ID and HomeBox UUIDs are not enumerable; this is the primary real-world limiting factor. The credential-disclosure payoff further requires that the victim actually configured a Shoutrrr notifier (Slack, SMTP, Telegram, Pushover, or Discord) with credentials embedded in the URL. Affects all versions prior to 0.26.0; no user interaction needed. Not exploitable by unauthenticated attackers.

This is a real, credible priority within its niche, but not a mass-exploitation threat. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N = 8.1 High) reflects a network-reachable, low-privilege authenticated cross-tenant access-control flaw (CWE-522 / effectively IDOR). The most important nuance the raw score hides: exploitation requires knowing another tenant's notifier UUID, which HomeBox generates as an unguessable UUID - enumeration is infeasible, so real-world attack complexity is higher than the AC:L in the vector suggests (I would rate AC:H). No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data - status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The C:H rating is well-justified because the leaked notifier URL contains PLAINTEXT Shoutrrr credentials (Slack/SMTP/Telegram/Pushover/Discord), enabling downstream account compromise. The vendor's I:H is arguably overstated: the integrity impact is limited to redirecting a victim's notifications to an attacker webhook, which is closer to I:L. Net: genuine credential-exposure bug with a clear source-confirmed fix, but gated behind authentication plus knowledge of a random UUID and concentrated in small self-hosted deployments - targeted risk, not widespread.

An attacker registers or already holds a low-privilege account on a shared HomeBox instance, obtains another tenant's notifier UUID, and sends PUT /v1/notifiers/{id}; the response returns that tenant's stored notifier URL containing plaintext Slack/SMTP/Telegram/Pushover/Discord credentials. The attacker then submits a replacement URL pointing at their own webhook, silently hijacking the victim's future notifications. No public exploit code is identified, but the flaw is trivial to exploit once a valid target UUID is known (AC:L per vendor, though UUID unguessability raises real-world difficulty).