Homebox
Monthly
Permanent destruction of an entire group's inventory in HomeBox is possible for any authenticated user who belongs to that group, due to a broken authorization check in the wipe-inventory action handler affecting versions prior to 0.26.0. The flaw lets a self-registered user - who is automatically flagged as a global owner of their own group - select a different group via the X-Tenant header and invoke POST /v1/actions/wipe-inventory against it, deleting data that cannot be recovered without external backups. Exploitation requires an authenticated account on a multi-group instance where the attacker is also a legitimate member of the victim group, so single-user or single-group deployments are not affected; no public exploit identified at time of analysis.
Cross-tenant record tampering in HomeBox versions prior to 0.26.0 allows an authenticated low-privileged user to overwrite or permanently delete another group's maintenance entries by supplying a maintenance-entry UUID that belongs to a different tenant. The flaw is a CWE-639 broken object-level authorization (IDOR) in the maintenance-entry update and delete repository paths, which act on the caller-supplied ID without confirming the record belongs to the caller's active group; exploitation requires a valid session plus knowledge of a non-enumerable random UUID, so it is access-gated rather than trivially reachable and is practically limited to multi-group/multi-tenant deployments. Impact is blind write/delete only with no data disclosure, and there is no public exploit identified at time of analysis and no indication of active exploitation. Vendor-released patch: 0.26.0.
HomeBox versions prior to 0.26.0 allow an authenticated low-privilege user to read and overwrite another tenant's notification configuration via PUT /v1/notifiers/{id}, exposing plaintext Shoutrrr credentials (Slack, SMTP, Telegram, Pushover, Discord) that are stored inside the notifier URL. The primary assessed impact is credential disclosure (high confidentiality), with a more limited integrity impact from the ability to point the victim's notifications at an attacker-controlled webhook. Exploitation requires a multi-tenant HomeBox deployment, a valid account, and knowledge of the victim's notifier UUID - UUIDs are not enumerable, which is the main real-world limiting factor; no public exploit has been identified at time of analysis, and the vendor fixed the issue in 0.26.0.
Broken access control in HomeBox prior to 0.25.0 allows authenticated users with revoked group access to continue performing full CRUD operations via API. After group invitation revocation, the defaultGroup ID persists on the user object, and when API requests omit the X-Tenant header, this unvalidated value enables bypassing access controls to read, modify, and delete group inventory data. Web interface correctly enforces revocation, creating a dangerous inconsistency. No active exploitation confirmed (EPSS data unavailable), but the authentication bypass tag and CVSS 8.1 with network vector indicate significant risk for multi-tenant HomeBox deployments.
Homebox prior to version 0.24.0 fails to validate the TrustProxy configuration setting, allowing attackers to bypass authentication rate limiting by forging the X-Real-IP header on direct connections. This enables an attacker to attempt unlimited authentication attempts by spoofing a different IP address for each request, compromising both confidentiality and integrity of the system. The vulnerability affects all Homebox installations where the TrustProxy option is disabled or misconfigured.
Authenticated server-side request forgery in HomeBox before 0.27.0 lets any member of a collection point a generic notifier at a permitted host that then 302/307/308-redirects to loopback, link-local, RFC1918 or cloud-metadata addresses, because the redirect hop is followed without re-running the product's SSRF policy. The flaw is reachable immediately through POST /api/v1/notifiers/test and asynchronously through stored notifiers during scheduled maintenance delivery, giving low-impact read/write access to internal endpoints (CVSS 6.4, PR:L, scope-changed). No public exploit code or KEV listing was identified at time of analysis, and the vendor shipped a fix in 0.27.0.
Server-side request forgery in HomeBox prior to 0.26.0 allows an authenticated user with permission to create or test notifiers to reach internal IPv4 destinations that the default BlockBogonNets and BlockCloudMetadata guards are meant to stop, because those guards do not decode IPv4 addresses embedded in NAT64/DNS64 prefixes. Impact is real but conditionally gated: exploitation requires the HomeBox instance's outbound traffic to egress through a NAT64/DNS64 gateway, since without such a gateway the crafted IPv6 destination is unroutable; where present, an attacker can direct the generic:// notifier at cloud metadata or localhost and use the notifier-test response (propagated by Shoutrrr) to read back retrieved data such as temporary credentials. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the vendor has released a fix in version 0.26.0.
Broken authorization in HomeBox prior to 0.26.0 lets any authenticated low-privilege user force an arbitrary account into their own group by POSTing a victim's userId to /v1/groups/members, with no owner role, invitation token, victim consent, or victim notification required. The direct impact is unauthorized group enrollment plus disclosure of the target's email address and name through the resulting member list (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), and the forced membership also satisfies the prerequisite for chaining a separate cross-group inventory-wipe issue. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; the endpoint and handler were removed entirely in the 0.26.0 fix, so patched instances are not exploitable.
Homebox prior to 0.24.0-rc.1 allows authenticated users to trigger HTTP POST requests to arbitrary destinations through the notifier feature without host or port validation, enabling attackers to enumerate internal services by observing application behavior differences based on network responses. The vulnerability affects all users with authentication access to the notifier functionality and carries a medium risk due to its reliance on behavioral side-channels rather than direct information disclosure.
Stored XSS in Homebox prior to 0.24.0-rc.1 allows authenticated users to upload malicious HTML or SVG files containing executable JavaScript that runs in the application's security context when accessed by other users. An attacker with valid credentials can exploit improper file type validation in the attachment upload feature to execute arbitrary scripts against victims viewing the malicious files. The vulnerability has been patched in version 0.24.0-rc.1.
Permanent destruction of an entire group's inventory in HomeBox is possible for any authenticated user who belongs to that group, due to a broken authorization check in the wipe-inventory action handler affecting versions prior to 0.26.0. The flaw lets a self-registered user - who is automatically flagged as a global owner of their own group - select a different group via the X-Tenant header and invoke POST /v1/actions/wipe-inventory against it, deleting data that cannot be recovered without external backups. Exploitation requires an authenticated account on a multi-group instance where the attacker is also a legitimate member of the victim group, so single-user or single-group deployments are not affected; no public exploit identified at time of analysis.
Cross-tenant record tampering in HomeBox versions prior to 0.26.0 allows an authenticated low-privileged user to overwrite or permanently delete another group's maintenance entries by supplying a maintenance-entry UUID that belongs to a different tenant. The flaw is a CWE-639 broken object-level authorization (IDOR) in the maintenance-entry update and delete repository paths, which act on the caller-supplied ID without confirming the record belongs to the caller's active group; exploitation requires a valid session plus knowledge of a non-enumerable random UUID, so it is access-gated rather than trivially reachable and is practically limited to multi-group/multi-tenant deployments. Impact is blind write/delete only with no data disclosure, and there is no public exploit identified at time of analysis and no indication of active exploitation. Vendor-released patch: 0.26.0.
HomeBox versions prior to 0.26.0 allow an authenticated low-privilege user to read and overwrite another tenant's notification configuration via PUT /v1/notifiers/{id}, exposing plaintext Shoutrrr credentials (Slack, SMTP, Telegram, Pushover, Discord) that are stored inside the notifier URL. The primary assessed impact is credential disclosure (high confidentiality), with a more limited integrity impact from the ability to point the victim's notifications at an attacker-controlled webhook. Exploitation requires a multi-tenant HomeBox deployment, a valid account, and knowledge of the victim's notifier UUID - UUIDs are not enumerable, which is the main real-world limiting factor; no public exploit has been identified at time of analysis, and the vendor fixed the issue in 0.26.0.
Broken access control in HomeBox prior to 0.25.0 allows authenticated users with revoked group access to continue performing full CRUD operations via API. After group invitation revocation, the defaultGroup ID persists on the user object, and when API requests omit the X-Tenant header, this unvalidated value enables bypassing access controls to read, modify, and delete group inventory data. Web interface correctly enforces revocation, creating a dangerous inconsistency. No active exploitation confirmed (EPSS data unavailable), but the authentication bypass tag and CVSS 8.1 with network vector indicate significant risk for multi-tenant HomeBox deployments.
Homebox prior to version 0.24.0 fails to validate the TrustProxy configuration setting, allowing attackers to bypass authentication rate limiting by forging the X-Real-IP header on direct connections. This enables an attacker to attempt unlimited authentication attempts by spoofing a different IP address for each request, compromising both confidentiality and integrity of the system. The vulnerability affects all Homebox installations where the TrustProxy option is disabled or misconfigured.
Authenticated server-side request forgery in HomeBox before 0.27.0 lets any member of a collection point a generic notifier at a permitted host that then 302/307/308-redirects to loopback, link-local, RFC1918 or cloud-metadata addresses, because the redirect hop is followed without re-running the product's SSRF policy. The flaw is reachable immediately through POST /api/v1/notifiers/test and asynchronously through stored notifiers during scheduled maintenance delivery, giving low-impact read/write access to internal endpoints (CVSS 6.4, PR:L, scope-changed). No public exploit code or KEV listing was identified at time of analysis, and the vendor shipped a fix in 0.27.0.
Server-side request forgery in HomeBox prior to 0.26.0 allows an authenticated user with permission to create or test notifiers to reach internal IPv4 destinations that the default BlockBogonNets and BlockCloudMetadata guards are meant to stop, because those guards do not decode IPv4 addresses embedded in NAT64/DNS64 prefixes. Impact is real but conditionally gated: exploitation requires the HomeBox instance's outbound traffic to egress through a NAT64/DNS64 gateway, since without such a gateway the crafted IPv6 destination is unroutable; where present, an attacker can direct the generic:// notifier at cloud metadata or localhost and use the notifier-test response (propagated by Shoutrrr) to read back retrieved data such as temporary credentials. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the vendor has released a fix in version 0.26.0.
Broken authorization in HomeBox prior to 0.26.0 lets any authenticated low-privilege user force an arbitrary account into their own group by POSTing a victim's userId to /v1/groups/members, with no owner role, invitation token, victim consent, or victim notification required. The direct impact is unauthorized group enrollment plus disclosure of the target's email address and name through the resulting member list (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), and the forced membership also satisfies the prerequisite for chaining a separate cross-group inventory-wipe issue. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; the endpoint and handler were removed entirely in the 0.26.0 fix, so patched instances are not exploitable.
Homebox prior to 0.24.0-rc.1 allows authenticated users to trigger HTTP POST requests to arbitrary destinations through the notifier feature without host or port validation, enabling attackers to enumerate internal services by observing application behavior differences based on network responses. The vulnerability affects all users with authentication access to the notifier functionality and carries a medium risk due to its reliance on behavioral side-channels rather than direct information disclosure.
Stored XSS in Homebox prior to 0.24.0-rc.1 allows authenticated users to upload malicious HTML or SVG files containing executable JavaScript that runs in the application's security context when accessed by other users. An attacker with valid credentials can exploit improper file type validation in the attachment upload feature to execute arbitrary scripts against victims viewing the malicious files. The vulnerability has been patched in version 0.24.0-rc.1.