HomeBox EUVD-2026-84035

Requires only a valid low-privilege authenticated HomeBox account (PR:L) reaching a network-accessible instance running a version prior to 0.26.0; the attacker calls POST /v1/groups/members supplying the target's userID. What LIMITS exploitation: the vulnerable HandleGroupMemberAdd endpoint and route exist only before 0.26.0 (removed by commit ed3216a8), so patched instances are not exploitable; the attacker must know or obtain the target user's userID; and direct impact is capped at disclosing the target's email and name plus forced group enrollment. The higher-impact outcome (inventory wipe) requires additionally chaining the separate cross-group wipe vulnerability. No user interaction by the victim and no owner/admin role are needed.

This is a genuine broken-authorization/broken-workflow flaw (CWE-841) but a moderate-severity one, and the signals are consistent rather than conflicting. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N = 5.4) is well-calibrated: exploitation is network-reachable and trivial once you hold any authenticated account, but it requires that low-privilege authentication (PR:L) and yields only low-impact confidentiality (a target user's email and name via the resulting member list) and low-impact integrity (forcibly enrolling a foreign account into your group). There is no availability impact directly. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' SSVC framework data was not supplied. The real priority driver is not the direct impact but the chaining note in the description: this membership-forcing bug is the stated prerequisite for a separate cross-group inventory-wipe vulnerability (tracked separately, sibling CVE-2026-48826, fixed in the same commit ed3216a8) which carries I:H/A:H. Treated in isolation this is a low-to-medium real-world risk; treated as a chain enabler it deserves patching alongside the wipe fix. Note the input Tags label this 'Information Disclosure,' which captures the email/name leak but understates the authorization/broken-access-control root cause.

An attacker registers or already holds any ordinary HomeBox account, then sends POST /v1/groups/members with a victim's userID as the payload. The server (pre-0.26.0) enrolls that victim into the attacker's group with no owner check, invitation token, consent, or notification, exposing the victim's email and name in the group member list and establishing the cross-group membership needed to later trigger the separate inventory-wipe flaw. No public proof-of-concept is referenced in the provided data.