CVE-2026-48974
Received Received - Intake

Unauthorized Group Membership Addition in HomeBox

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring an owner role, an invitation token, target-user consent, or target-user notification. Any authenticated user can force another account into the caller's group, disclose the target user's email address and name through the resulting member list, and create the membership prerequisite used by a separate cross-group inventory-wipe vulnerability. This issue is fixed in version 0.26.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-48974
EUVD
EUVD-2026-84035

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sysadminsmedia homebox to 0.26.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-841 The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

HomeBox before version 0.26.0 has a vulnerability in the POST /v1/groups/members endpoint. Any authenticated user can add another user to their group by providing a user ID without needing an owner role, invitation token, or the target user's consent. This exposes the target user's email and name through the group members list.

Detection Guidance

To detect this vulnerability, check Homebox logs for unusual POST requests to /v1/groups/members with userID parameters from non-owner accounts. Monitor group membership changes and verify if unauthorized users are added without invitations or consent.

Impact Analysis

An attacker could add you to their group without your consent, exposing your personal information like email and name. This forced membership could also enable further attacks such as cross-group inventory destruction.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data (email and name) without consent and failing to ensure proper data protection controls. It may also breach HIPAA if user data is mishandled in a healthcare context, as unauthorized group membership could lead to improper access to sensitive information.

Mitigation Strategies

Immediately upgrade Homebox to version 0.26.0 or later. If upgrading is not possible, restrict access to the /v1/groups/members endpoint and implement role-based authorization checks to prevent unauthorized group membership additions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48974. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart