CVE-2026-48976

Summary

The flaw allows an authenticated user to read and potentially modify notifiers belonging to other tenants, exposing sensitive credentials and redirecting notifications to attacker-controlled webhooks.

Exploitability

Exploitation requires authentication as a tenant with access to another tenant's notifier UUID. The difficulty depends on the system’s access controls and user management practices.

Blast radius

If exploited, this could lead to unauthorized access to sensitive communication channels and loss of control over notification flows for multiple users.

Prioritized remediation

Update to HomeBox version 0.26.0 or later to apply the necessary security fixes.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.