EUVD-2026-23539Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with valid credentials
-
DeliveryIdentify previous group's defaultGroup ID
-
ExploitCraft API request omitting X-Tenant header
-
ExecutionExecute CRUD operations on revoked group
-
ImpactAccess confidential inventory data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Incorrect ownership assignment
|
| Exploitation Conditions | Requires authenticated user account (PR:L) with previous membership in a HomeBox group that has since been revoked. The vulnerability manifests specifically when API requests omit the X-Tenant header, causing the system to fall back to the unvalidated defaultGroup value. Exploitation is possible from any network location (AV:N) against default HomeBox API configurations. Does NOT require: administrative privileges, special client software beyond basic HTTP capabilities, or non-default configuration. Limiting factors: attacker must have been legitimately invited to a group at some point (not exploitable by users never granted group access), and cannot escalate to groups they were never members of. The web UI correctly blocks access, so exploitation requires direct API interaction rather than browser-based attacks. |
| Impact | Real-world risk is HIGH for multi-tenant deployments. CVSS 8.1 reflects accurate severity: network vector (AV:N) enables remote exploitation, low complexity (AC:L) requires no special conditions, low privileges (PR:L) means any authenticated user with prior group membership, and high confidentiality/integrity impact (C:H/I:H) allows full data access and modification. The Authentication Bypass tag confirms this is an access control failure. Key risk factors: vulnerability affects default API behavior (omitting X-Tenant header), exploitation requires only prior group membership (common in legitimate use), and the inconsistency between UI and API creates false security confidence. Mitigating factors: requires existing account credentials (PR:L), no availability impact (A:N), and unscopable (S:U) limits lateral movement. Without EPSS data, base exploitation likelihood on: attack simplicity, authentication bypass classification, and patch availability in version 0.25.0. Priority is HIGH for any HomeBox instance with multiple groups or revoked user access, MEDIUM for single-user deployments where the multi-tenant feature is unused. |
| Exploit ScenarioDerived | An administrator removes Alice from a shared household inventory group after she moves out. Alice retains her HomeBox account credentials. She crafts direct API requests to HomeBox endpoints without including the X-Tenant header, and because her defaultGroup ID was never cleared during revocation, the API treats her requests as authorized for that group. Alice can now read all inventory items, modify asset values, or delete critical records for a household she no longer belongs to, while the web interface would correctly deny her access if she attempted to log in normally. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 17, 2026
Broken access control in HomeBox prior to 0.25.0 allows authenticated users with revoked group access to continue performing full CRUD operations via API. After group invitation revocation, the defaultGroup ID persists on the user object, and when API requests omit the X-Tenant header, this unvalidated value enables bypassing access controls to read, modify, and delete group inventory data. Web interface correctly enforces revocation, creating a dangerous inconsistency. No active exploitation confirmed (EPSS data unavailable), but the authentication bypass tag and CVSS 8.1 with network vector indicate significant risk for multi-tenant HomeBox deployments.
RemediationAI
Upgrade to HomeBox version 0.25.0 or later, which fixes the defaultGroup persistence and X-Tenant validation issues. Release information is at https://github.com/sysadminsmedia/homebox/releases/tag/v0.25.0. If immediate upgrade is not feasible, implement API gateway-level enforcement requiring X-Tenant header on all API requests and rejecting requests without it (this prevents the vulnerable code path but may break legitimate client applications expecting implicit tenant context). Alternatively, conduct audit of all users with revoked group access and manually clear their defaultGroup field through database manipulation, though this is error-prone and doesn't address the underlying validation gap. For high-security environments, disable multi-tenant group features entirely until upgrade is completed. All workarounds have operational impact and should be considered temporary measures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HomeBox is a home inventory and organization system (cpe:2.3:a:sysadminsmedia:homebox) with multi-tenant group functionality. The vulnerability stems from CWE-708 (Incorrect Ownership Assignment), where user identity management fails during group access revocation. The system uses a defaultGroup field on user objects and an X-Tenant header for API tenant isolation. When users are invited to groups, defaultGroup is set but never cleared upon revocation. The API's tenant validation logic improperly trusts this persisted defaultGroup value when X-Tenant is absent, treating it as an implicit authorization. This creates a privilege escalation path where revoked users retain API-level access while UI-level controls function correctly, indicating inconsistent authorization enforcement across application layers.
Know when Homebox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultGroup ID remained permanently assigned to a user after being invited to a group, even after their access to that group was revoked. While the web interface correctly enforced the access revocation and prevented the user from viewing or modifying the group's contents, the API did not. Because the original group ID persisted as the user's defaultGroup, and this value was not properly validated when the X-Tenant header was omitted, the user could still perform full CRUD operations on the group's collections through the API, bypassing the intended access controls. This issue has been fixed in version 0.25.0.
Executive ViewAI
HomeBox versions prior to 0.25.0 contain a broken access control vulnerability that allows authenticated users whose group access has been revoked to retain full read, modify, and delete permissions on group inventory through the API, creating a critical inconsistency between web and API enforcement. Organizations operating multi-tenant HomeBox deployments face unauthorized data access and modification risks, particularly where API integrations or third-party tools bypass the web interface controls.
Implement mandatory X-Tenant header validation at network ingress using WAF rules to reject API requests lacking explicit tenant identification; disable direct API access for users with revoked group membership via reverse proxy authentication controls; enable detailed API audit logging to detect unauthorized inventory access patterns; restrict API token issuance and implement token expiration policies aligned with group access changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Permanent destruction of an entire group's inventory in HomeBox is possible for any authenticated user who belongs to th
Cross-tenant record tampering in HomeBox versions prior to 0.26.0 allows an authenticated low-privileged user to overwri
HomeBox versions prior to 0.26.0 allow an authenticated low-privilege user to read and overwrite another tenant's notifi
Homebox prior to version 0.24.0 fails to validate the TrustProxy configuration setting, allowing attackers to bypass aut
Authenticated server-side request forgery in HomeBox before 0.27.0 lets any member of a collection point a generic notif
Server-side request forgery in HomeBox prior to 0.26.0 allows an authenticated user with permission to create or test no
Broken authorization in HomeBox prior to 0.26.0 lets any authenticated low-privilege user force an arbitrary account int
Homebox prior to 0.24.0-rc.1 allows authenticated users to trigger HTTP POST requests to arbitrary destinations through
Stored XSS in Homebox prior to 0.24.0-rc.1 allows authenticated users to upload malicious HTML or SVG files containing e
Exploit-DB