CVE-2026-48826 Details
Description
HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1/v1_ctrl_actions.go authorizes POST /v1/actions/wipe-inventory through the global ctx.User.IsOwner value instead of the caller's role in the active group, while the active group is selected through the X-Tenant request header. Because every self-registered user who creates a group receives the global owner value, a user who is also a member of another group can select that group with X-Tenant and permanently delete its complete inventory, which is not recoverable without external backups. This issue is fixed in version 0.26.0.
A vulnerability in Homebox versions through 0.25.0 allows users to permanently delete the entire inventory of any group they belong to. This issue arises because the 'HandleWipeInventory' function in the API improperly authorizes inventory deletion requests. It relies on a global owner role assigned to users who create their own groups, instead of checking the user's role within the specific group being targeted. Exploitation is achieved by sending a request to wipe inventory while specifying the group to be affected via the 'X-Tenant' header. This deletion is irreversible for self-hosted instances without external backups.
Users can upgrade to Homebox version 0.26.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sysadminsmedia/homebox/commit/ed3216a80998dfd81d4418700696244144883160 | [email protected] | Source CodeVendor |
| https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0 | [email protected] | Release NotesVendor |
| https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-559j-7w3w-4fr7 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sysadminsmedia HomeBox | <= 0.25.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |