An authorization bypass vulnerability in HomeBox allows authenticated users to access and manipulate sensitive notification credentials belonging to other tenants, posing a significant risk of data exposure.

This vulnerability occurs due to a lack of proper authorization checks in the NotifierRepository.Update function (CWE-639), where the application fails to verify if the record's user ID matches the authenticated user. By supplying another tenant's notifier UUID to the PUT /v1/notifiers/{id} endpoint, an authenticated attacker can access plaintext credentials or redirect notification traffic to an external webhook.

The exploitation of this flaw leads to the unauthorized disclosure of sensitive third-party credentials, such as those used for Slack, SMTP, Telegram, Pushover, or Discord. With a CVSS score of 8.1 (High), this vulnerability presents a serious risk to data confidentiality and integrity, as an attacker could intercept private system notifications or masquerade as a legitimate service to disrupt business communication.

Immediate Action: Upgrade to HomeBox version 0.26.0 or later immediately to apply the necessary authorization logic fixes.

Proactive Monitoring: Review application access logs for suspicious PUT requests to the /v1/notifiers/ endpoint, specifically monitoring for instances where a single user ID interacts with multiple unique notifier UUIDs.

Compensating Controls: Implement strict network access controls or a Web Application Firewall (WAF) to limit access to the internal API endpoints and restrict potential lateral movement between tenant data containers.

Public Exploit Available: No (exploit_available: false)

Given the potential for complete credential exposure within the notification system, administrators must prioritize the update to version 0.26.0. Organizations should verify that all instances of HomeBox are running the patched version and audit existing notification configurations to ensure no unauthorized webhooks were established prior to the patch.