Executive Summary

The vulnerability exists in HomeBox versions prior to 0.25.0 where a user's defaultGroup ID remained assigned even after their access to that group was revoked.

While the web interface correctly prevented the user from accessing the group after revocation, the API did not enforce this restriction.

Because the defaultGroup ID was not properly validated when the X-Tenant header was missing, the user could still perform full create, read, update, and delete (CRUD) operations on the group's collections through the API, bypassing intended access controls.

This issue was fixed in version 0.25.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a user whose access to a group has been revoked to still manipulate that group's data through the API.

Specifically, the user can perform full CRUD operations on the group's collections, potentially leading to unauthorized data modification or exposure.

Such unauthorized access can compromise the integrity and confidentiality of the group's data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade HomeBox to version 0.25.0 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a user to bypass intended access controls via the API, enabling unauthorized full CRUD operations on group collections even after access revocation.

Such unauthorized access and potential data manipulation could lead to violations of data protection and privacy regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive information.

Therefore, the vulnerability may negatively impact compliance by exposing data to unauthorized users and failing to enforce proper access restrictions.

Useful 0 Not Useful 0