Read the docs
TI-2026-29010 Aliases CVE-2026-40196

HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation

Priority LOW 37CWE-708Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultGroup ID remained permanently assigned to a user after being invited to a group, even after their access to that group was revoked. While the web interface correctly enforced the access revocation and prevented the user from viewing or modifying the group's contents, the API did not. Because the original group ID persisted as the user's defaultGroup, and this value was not properly validated when the X-Tenant header was omitted, the user could still perform full CRUD operations on the group's collections through the API, bypassing the intended access controls. This issue has been fixed in version 0.25.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00247 16th percentileScored 2026-11-07
Fix Fixed homebox (sysadminsmedia): 0.25.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sysadminsmediahomeboxbefore 0.25.00.25.0Patch availableCNA
  • homebox Vendorsysadminsmedia Affected before 0.25.0 Fixed in 0.25.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sysadminsmedia:homebox:*:*:*:*:*:*:*:*before 0.25.0Vulnerablesysadminsmedia
  • cpe:2.3:a:sysadminsmedia:homebox:*:*:*:*:*:*:*:* Versions before 0.25.0 Vulnerable ·sysadminsmedia

Remediation

  • Fix · CNA homebox (sysadminsmedia) Fixed in 0.25.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40196

References

Advisory 1

Other 1

  • TI-2026-22323 HomeBox has an Auth Rate Limit Bypass via IP Spoofing CVSS 3.1HIGH 7.4
  • TI-2026-21242 HomeBox affected by Stored XSS via HTML/SVG Attachment Upload CVSS 3.1MEDIUM 5.4
  • TI-2026-21986 HomeBox affected by Blind SSRF CVSS 3.1MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences