CVE-2026-48826
Received Received - Intake

Authorization Bypass in HomeBox Inventory Deletion

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1/v1_ctrl_actions.go authorizes POST /v1/actions/wipe-inventory through the global ctx.User.IsOwner value instead of the caller's role in the active group, while the active group is selected through the X-Tenant request header. Because every self-registered user who creates a group receives the global owner value, a user who is also a member of another group can select that group with X-Tenant and permanently delete its complete inventory, which is not recoverable without external backups. This issue is fixed in version 0.26.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-48826
EUVD
EUVD-2026-84036

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sysadminsmedia homebox to 0.26.0 (exc)
sysadminsmedia homebox 0.26.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in HomeBox allows a user to delete the entire inventory of any group they belong to by manipulating the X-Tenant request header. The issue occurs because the system checks a global owner flag instead of the user's role within the active group. This authorization bypass enables permanent data loss for groups without backups.

Detection Guidance

To detect this vulnerability, check if your Homebox instance is running a version prior to 0.26.0. Use the command: docker inspect --format='{{.Config.Image}}' <container_name> to verify the image version. If the output shows a version less than 0.26.0, the system is vulnerable.

Impact Analysis

If you use HomeBox versions 0.25.0 or earlier, an attacker who is a member of your group could wipe your entire inventory by sending a crafted request. This results in irreversible data loss unless you have external backups. The vulnerability has a high severity score of 8.1 due to its impact on data integrity and availability.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by causing unauthorized data deletion, violating integrity and availability requirements. Permanent data loss without backups may result in violations of data protection obligations, especially if the deleted data includes sensitive personal or health information.

Mitigation Strategies

Immediately upgrade Homebox to version 0.26.0 or later. Before upgrading, back up your database and files as the update includes significant backend changes. Use the command: docker pull ghcr.io/sysadminsmedia/homebox:0.26.0 to pull the patched version, then restart the container.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48826. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart