CVE-2026-48975
Received Received - Intake

Unauthorized Maintenance Entry Modification in HomeBox

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repo_maintenance_entry.go use UpdateOneID(id) and DeleteOneID(id) without verifying that the maintenance entry belongs to the authenticated user's active group. An authenticated low-privileged user who knows or enumerates another tenant's maintenance-entry UUID can overwrite that record or permanently delete it. This issue is fixed in version 0.26.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-48975
EUVD
EUVD-2026-84034

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sysadminsmedia homebox to 0.26.0 (exc)
sysadminsmedia homebox 0.26.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48975 is a Cross-Tenant Insecure Direct Object Reference (IDOR) vulnerability in HomeBox affecting versions 0.25.0 and earlier. The issue occurs in MaintenanceEntryRepository.Update and Delete functions which do not verify if a maintenance entry belongs to the authenticated user's group. This allows any authenticated low-privileged user to overwrite or delete another tenant's maintenance records by manipulating the record's UUID.

Detection Guidance

To detect this vulnerability, check if your HomeBox instance is running a version prior to 0.26.0. Use commands like 'curl -s https://your-homebox-url/version' or inspect the application logs for version details. Verify if multiple users share the same maintenance entry UUIDs without proper access controls.

Impact Analysis

This vulnerability allows an authenticated user to tamper with or delete another user's maintenance history without elevated privileges. Attackers can overwrite or permanently delete maintenance records by knowing or enumerating another tenant's maintenance-entry UUID, impacting data integrity and availability.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by allowing unauthorized modification or deletion of maintenance records, which may contain sensitive personal or health-related data. Loss of data integrity and availability violates regulatory requirements for data protection and audit trails.

Mitigation Strategies

Immediately upgrade HomeBox to version 0.26.0 or later. If upgrading is not possible, restrict access to maintenance entry endpoints and implement user-group validation checks. Review and audit all maintenance entries for unauthorized modifications or deletions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48975. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart