Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

HomeBox lets users modify groups via API after removal

CVE-2026-40196 · published 6 months ago
Summary

In HomeBox versions before 0.25.0, a user's default group setting stayed active even after they were removed from that group. While the web interface blocked access, the API could still be used to change the group's data. Upgrade to version 0.25.0 to stop this behavior.

What to do
  • Update sysadminsmedia homebox to version 0.25.0 or later.
Affected software
VendorProductAffected versions
sysadminsmedia homebox < 0.25.0
cpe:2.3:a:sysadminsmedia:homebox:*:*:*:*:*:*:*:*
Original advisory text
HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation
HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultGroup ID remained permanently assigned to a user after being invited to a group, even after their access to that group was revoked. While the web interface correctly enforced the access revocation and prevented the user from viewing or modifying the group's contents, the API did not. Because the original group ID persisted as the user's defaultGroup, and this value was not properly validated when the X-Tenant header was omitted, the user could still perform full CRUD operations on the group's collections through the API, bypassing the intended access controls. This issue has been fixed in version 0.25.0.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-708Incorrect Ownership Assignment
Timeline
Published17 Apr 2026
Updated4 Nov 2026
First seen17 Apr 2026
Sources
CVE-2026-40196 · NVD
CVE-2026-40196 · OSV
GHSA-6pvm-v73p-p6m9 · GHSA
Track software like this
Free during beta