HomeBox EUVD-2026-84036

Requires an authenticated account on a multi-group HomeBox deployment where the attacker is a member of the victim group. Specifically: the attacker must have self-registered (which grants the global ctx.User.IsOwner=true value by virtue of owning their own created group) and must also hold non-owner membership in the target group; exploitation is performed by sending POST /v1/actions/wipe-inventory with the X-Tenant request header set to the target group's identifier. Limiting factors: single-user or single-group instances are not exploitable (no second group to target), and the attacker must already be a legitimate member of the victim group - this is an insider/multi-tenant privilege-escalation condition, not anonymous remote destruction. Impact is unrecoverable inventory deletion unless external backups exist.

This is a genuine, well-substantiated authorization flaw with high real-world plausibility for multi-user HomeBox instances, though its blast radius is bounded by deployment topology. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, 8.1) is credible and I largely agree with it: unlike the sibling IDOR CVEs in the same fix commit (CVE-2026-48975 notifier, CVE-2026-48976 maintenance) where exploitation depends on guessing an unguessable UUIDv4 (arguing for AC:H), this bug requires NO secret knowledge - the attacker simply needs to already be a member of the victim group and set the X-Tenant header to select it, so AC:L is fair here. C:N is correct (no data is read, only destroyed); I:H and A:H reflect permanent, unrecoverable deletion of an entire group's inventory. No EPSS score, no CISA KEV entry, and no public POC are present in the intelligence, so there is no signal of active or automated exploitation - this is a code-review/advisory-derived finding (GitHub_M via GHSA-559j-7w3w-4fr7), not an in-the-wild threat. Net: real priority for anyone running shared multi-group HomeBox, but the low product footprint and the required insider-membership precondition keep aggregate risk moderate rather than urgent.

An attacker self-registers on a shared HomeBox instance, creating their own group (which grants them the global IsOwner=true flag), and is subsequently invited into a second group as an ordinary non-owner member. They send POST /v1/actions/wipe-inventory with the X-Tenant header set to the second group's ID; because the handler checks the global owner flag rather than their role in the selected group, the request succeeds and permanently deletes that group's entire inventory. No public exploit code is identified, but the technique is trivial to reproduce from the advisory and diff.