CVE-2026-48974

HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring an owner role, an invitation token, target-user consent, or target-user notification. Any authenticated user can force another account into the caller's group, disclose the target user's email address and name through the resulting member list, and create the membership prerequisite used by a separate cross-group inventory-wipe vulnerability. This issue is fixed in version 0.26.0.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/sysadminsmedia/homebox/commit/ed3216a80998dfd81d4418700696244144883160
https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0
https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-ffcw-whqh-hgqf

Configurations

No configuration.

History

21 Sep 2026, 18:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-21 18:17

Updated : 2026-09-29 15:17

NVD link : CVE-2026-48974

Mitre link : CVE-2026-48974

CVE.ORG link : CVE-2026-48974

JSON object : View

Products Affected

No product.

CWE

CWE-841

Improper Enforcement of Behavioral Workflow

CWE-862

Missing Authorization

{"id": "CVE-2026-48974", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48974", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-29T14:13:26.298370Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "sysadminsmedia", "product": "homebox", "versions": [{"status": "affected", "version": "< 0.26.0"}]}]}], "published": "2026-09-21T18:17:08.240", "references": [{"url": "https://github.com/sysadminsmedia/homebox/commit/ed3216a80998dfd81d4418700696244144883160", "source": "security-advisories@github.com"}, {"url": "https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-ffcw-whqh-hgqf", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-841"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring an owner role, an invitation token, target-user consent, or target-user notification. Any authenticated user can force another account into the caller's group, disclose the target user's email address and name through the resulting member list, and create the membership prerequisite used by a separate cross-group inventory-wipe vulnerability. This issue is fixed in version 0.26.0."}], "lastModified": "2026-09-29T15:17:26.050", "sourceIdentifier": "security-advisories@github.com"}