CVE-2026-48974 Details
Description
HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring an owner role, an invitation token, target-user consent, or target-user notification. Any authenticated user can force another account into the caller's group, disclose the target user's email address and name through the resulting member list, and create the membership prerequisite used by a separate cross-group inventory-wipe vulnerability. This issue is fixed in version 0.26.0.
A vulnerability in Homebox versions prior to 0.26.0 allows any authenticated user to add another user to their group without consent, notification, or an invitation token. The issue arises because the AddMember function does not verify the caller's role or require owner authorization. This forced membership not only discloses the target user's email and name through the member list but also creates a prerequisite for a separate vulnerability that wipes inventory across groups.
Users can upgrade to Homebox version 0.26.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sysadminsmedia/homebox/commit/ed3216a80998dfd81d4418700696244144883160 | [email protected] | Source CodeVendor |
| https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0 | [email protected] | Release NotesVendor |
| https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-ffcw-whqh-hgqf | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-841 | Improper Enforcement of Behavioral Workflow | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sysadminsmedia HomeBox | <= 0.25.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | New CVE Received | [email protected] |