CVE-2026-48976

{
  "etk_id": "ETK-2026-1896",
  "cve_id": "CVE-2026-48976",
  "display_id": "CVE-2026-48976",
  "ghsa_id": "GHSA-mc8h-5c5v-37p7",
  "euvd_id": "EUVD-2026-84033",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Cross-tenant notifier authorization flaw in Homebox",
  "summary": "Homebox versions before 0.26.0 do not enforce ownership when updating notifiers. An authenticated user who knows another tenant's notifier identifier may expose credentials embedded in its notification URL and change the destination for that tenant's alerts.",
  "mitigation": "Upgrade Homebox to version 0.26.0 or later. Rotate notifier-service credentials and review notifier destinations if cross-tenant access may have occurred.",
  "vendor": "docker",
  "product": "docker:sysadminsmedia/homebox",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 0.25.0"
      ],
      "ecosystem": "docker",
      "fixed_versions": [
        "0.26.0"
      ],
      "package_name": "sysadminsmedia/homebox",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 0.25.0"
      ],
      "ecosystem": "docker",
      "fixed_versions": [
        "0.26.0"
      ],
      "package_name": "ghcr.io/sysadminsmedia/homebox",
      "purl": null
    }
  ],
  "cwes": [
    522
  ],
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": 0.0045,
  "epss_percentile": 0.377,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 18.649362933333332,
  "t0_at": "2026-09-21T17:41:16.889000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-17T18:19:21.660414+00:00",
      "days": 26.026444113587964,
      "is_lower_bound": false,
      "measured_at": "2026-09-21T17:41:16.889000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-09-21T17:41:16.889000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-21T17:41:16.889000+00:00",
      "url": "https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-mc8h-5c5v-37p7"
    }
  }
}