A critical IDOR in HomeBox’s notifier update endpoint allows an authenticated user to act on notifiers belonging to other tenants without restriction. This omission permits the attacker to retrieve the notifier’s stored URL, which often contains plain‑text Shoutrrr credentials for services such as Slack, SMTP, Telegram, Pushover, or Discord. Because the URL can also be overwritten, the attacker can redirect legitimate notifications to a malicious webhook, effectively hijacking delivery.

The flaw exists in HomeBox versions prior to 0.26.0. Affected vendors and products include sysadminsmedia’s HomeBox inventory platform. All installations that have not applied the 0.26.0 update are vulnerable. The issue was addressed in the 0.26.0 release; newer releases are not impacted.

With a CVSS score of 8.1 the vulnerability is classified as high severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires only that the victim is authenticated to the affected instance and that the attacker knows a valid notifier UUID belonging to another tenant. Because the API is exposed via HTTP PUT /v1/notifiers/{id}, an attacker can leverage the IDOR without installing malware, making the attack relatively straightforward for an internal adversary or a privileged external participant.