CVE-2026-40196
Access Control Bypass in HomeBox API via DefaultGroup ID
Publication date: 2026-04-17
Last updated on: 2026-04-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sysadminsmedia | homebox | to 0.25.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-708 | The product assigns an owner to a resource, but the owner is outside of the intended control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in HomeBox versions prior to 0.25.0 where a user's defaultGroup ID remained assigned even after their access to that group was revoked.
While the web interface correctly prevented the user from accessing the group after revocation, the API did not enforce this restriction.
Because the defaultGroup ID was not properly validated when the X-Tenant header was missing, the user could still perform full create, read, update, and delete (CRUD) operations on the group's collections through the API, bypassing intended access controls.
This issue was fixed in version 0.25.0.
How can this vulnerability impact me? :
This vulnerability allows a user whose access to a group has been revoked to still manipulate that group's data through the API.
Specifically, the user can perform full CRUD operations on the group's collections, potentially leading to unauthorized data modification or exposure.
Such unauthorized access can compromise the integrity and confidentiality of the group's data.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade HomeBox to version 0.25.0 or later, where the issue has been fixed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows a user to bypass intended access controls via the API, enabling unauthorized full CRUD operations on group collections even after access revocation.
Such unauthorized access and potential data manipulation could lead to violations of data protection and privacy regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive information.
Therefore, the vulnerability may negatively impact compliance by exposing data to unauthorized users and failing to enforce proper access restrictions.