EUVD-2026-84034Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged group member
-
DeliveryObtain/enumerate foreign maintenance-entry UUID
-
ExploitCall maintenance Update/Delete endpoint with that UUID
-
ExecutionRepository skips group-ownership check
-
ImpactOverwrite or permanently delete victim tenant's record
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires an authenticated low-privileged HomeBox account and knowledge of a valid maintenance-entry UUID belonging to a different group/tenant. Practically limited to multi-group/multi-tenant deployments (a single-household instance has no other tenant to target), and gated by the need to obtain a random UUID that is not readily enumerable. No user interaction by the victim is required (UI:N), and the flaw affects default configurations of versions prior to 0.26.0 - no special feature toggle is needed. Impact is blind write/delete only (no data disclosure). |
| Impact | This is a genuine but access-gated broken-authorization flaw (CWE-639 IDOR), not an inflated high-CVSS issue. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H = 8.1) drives severity from I:H+A:H, which is fair for arbitrary overwrite/deletion of other tenants' maintenance records. However, I dispute AC:L: the description itself says the attacker must 'know or enumerate another tenant's maintenance-entry UUID,' and HomeBox uses random UUIDs which are not practically enumerable - this is a meaningful complexity barrier that AC:L understates (AC:H is more defensible, lowering my score to ~6.8). C:N is correct because the operations are blind write/delete with no read-back. No EPSS score, no CISA KEV entry, and no public POC are present in the input; exploitation status is therefore 'no public exploit identified.' SSVC data was not provided. Net: a real priority for multi-tenant/shared HomeBox instances to patch, but the low deployment footprint plus the UUID-knowledge prerequisite make mass or automated exploitation unlikely. |
| Exploit ScenarioDerived | A legitimate low-privileged user on a shared HomeBox instance (multi-household/multi-group deployment) obtains or guesses a maintenance-entry UUID belonging to another group - e.g. via a leaked URL, log, or API reference. They call the maintenance update or delete endpoint with that UUID and, because the repository never checks group ownership, silently overwrite or permanently delete the victim group's maintenance record. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Cross-tenant record tampering in HomeBox versions prior to 0.26.0 allows an authenticated low-privileged user to overwrite or permanently delete another group's maintenance entries by supplying a maintenance-entry UUID that belongs to a different tenant. The flaw is a CWE-639 broken object-level authorization (IDOR) in the maintenance-entry update and delete repository paths, which act on the caller-supplied ID without confirming the record belongs to the caller's active group; exploitation requires a valid session plus knowledge of a non-enumerable random UUID, so it is access-gated rather than trivially reachable and is practically limited to multi-group/multi-tenant deployments. Impact is blind write/delete only with no data disclosure, and there is no public exploit identified at time of analysis and no indication of active exploitation. Vendor-released patch: 0.26.0.
RemediationAI
Upgrade HomeBox to version 0.26.0 or later, which scopes maintenance-entry updates and deletes to the authenticated user's active group (commit ed3216a80998dfd81d4418700696244144883160) and additionally removes the POST /v1/groups/members endpoint, reworks the owner check for inventory wipe, and adds the UserGroup entity; see the advisory at https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-7mr6-2wxw-27j9 and the release at https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0. If immediate upgrade is not possible, compensating controls must be applied with their trade-offs understood: consolidate to a single group/tenant per instance where practical (this removes the cross-tenant target entirely but breaks any legitimate multi-household sharing), restrict network access to the HomeBox API to trusted clients via a reverse proxy or firewall/VPN so only vetted users can hold an authenticated session (reduces the attacker population but does not fix the underlying missing ownership check), avoid exposing maintenance-entry UUIDs in shared logs, exports, or client code and rotate or regenerate any entries whose IDs may have leaked (raises the effort needed for the IDOR but is not a reliable substitute for patching, since IDs can be obtained from other endpoints or backups), and monitor server logs for update/delete requests against maintenance-entry IDs that the requesting group does not own. Note that running as an unprivileged, low-privilege HomeBox account does not by itself stop this class of attack, since the flaw is exactly a low-privilege horizontal escalation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HomeBox is a self-hosted home inventory and organization system written in Go, using an ent-generated ORM over a relational backend and a chi-based HTTP API under /v1 with bearer-token authentication. The vulnerable code lives in backend/internal/data/repo/repo_maintenance_entry.go, where MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete call the ent UpdateOneID(id) and DeleteOneID(id) helpers directly on the client-supplied maintenance-entry identifier, with no predicate tying the row to the authenticated group (GID). This is the textbook CWE-639 pattern: the object reference is user-controlled and the server fails to verify that the referenced object is within the caller's authorization scope, resulting in horizontal privilege escalation across tenants. The upstream fix (commit ed3216a80998dfd81d4418700696244144883160, shipped in release v0.26.0) threads the caller's group ID into the repository calls (Update(auth, auth.GID, entryID, body) and Delete(auth, auth.GID, entryID)), so the mutation is scoped to the active group. The same commit performs related authorization hardening: the POST /v1/groups/members handler and GroupService.AddMember were removed, the inventory-wipe handler's owner check was changed from the cached ctx.User.IsOwner flag to a live ctrl.repo.Groups.IsOwnerOf(ctx, ctx.UID, ctx.GID) lookup, and a new UserGroup ent entity/query edge was introduced. Per the authoritative assessment, the realistic attack surface is a multi-group or multi-tenant instance, since a single-household deployment has no second tenant to target, and the entry UUID is random rather than sequential, which raises the attack complexity relative to the base score. No confidentiality impact applies (C:N) because the operation is a blind write/delete.
Know when Homebox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Authenticated low-priv user (PR:L) over the network (AV:N); AC:H because a non-enumerable foreign UUID must be known; blind write/delete gives I:H/A:H but C:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repo_maintenance_entry.go use UpdateOneID(id) and DeleteOneID(id) without verifying that the maintenance entry belongs to the authenticated user's active group. An authenticated low-privileged user who knows or enumerates another tenant's maintenance-entry UUID can overwrite that record or permanently delete it. This issue is fixed in version 0.26.0.
Technical POC Analysis
CWE-639 (Authorization Bypass Through User-Controlled Key): a broken object-level authorization (IDOR) flaw in HomeBox's maintenance-entry repository layer.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A broken object-level authorization flaw in HomeBox, the self-hosted inventory and maintenance tracking platform, lets a low-privileged user with a valid session overwrite or permanently delete maintenance entries belonging to a different group. Only organizations running multi-group or multi-tenant HomeBox deployments are exposed, and the resulting loss is one of record integrity and availability rather than data disclosure. No public exploit code or active exploitation has been identified at the time of analysis, but the flaw undermines the tenant isolation that asset and facilities teams rely on for trustworthy records.
Upgrade to HomeBox 0.26.0, the fixed release identified in the advisory; note that the supplied patch field reports no patch available, so treat 0.26.0 as the remediation target and validate it after deployment. If the upgrade is delayed: run each HomeBox instance with a single group so no cross-tenant boundary exists, limit maintenance-entry write and delete rights to trusted administrators, have engineering confirm that update and delete paths verify record ownership against the caller's active group before acting on a supplied UUID, and monitor logs for unexpected modification or deletion of maintenance entries.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Permanent destruction of an entire group's inventory in HomeBox is possible for any authenticated user who belongs to th
HomeBox versions prior to 0.26.0 allow an authenticated low-privilege user to read and overwrite another tenant's notifi
Broken access control in HomeBox prior to 0.25.0 allows authenticated users with revoked group access to continue perfor
Homebox prior to version 0.24.0 fails to validate the TrustProxy configuration setting, allowing attackers to bypass aut
Server-side request forgery in HomeBox prior to 0.26.0 allows an authenticated user with permission to create or test no
Broken authorization in HomeBox prior to 0.26.0 lets any authenticated low-privilege user force an arbitrary account int
Homebox prior to 0.24.0-rc.1 allows authenticated users to trigger HTTP POST requests to arbitrary destinations through
Stored XSS in Homebox prior to 0.24.0-rc.1 allows authenticated users to upload malicious HTML or SVG files containing e
Exploit-DB