CVE-2026-48826: HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching
HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1/v1ctrlactions.go authorizes POST /v1/actions/wipe-inventory through the global ctx.User.IsOwner value instead of the caller's role in the active group, while the active group is selected through the X-Tenant request header. Because every self-registered user who creates a group receives the global owner value, a user who is also a member of another group can select that group with X-Tenant and permanently delete its complete inventory, which is not recoverable without external backups. This issue is fixed in version 0.26.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HomeBoxto a version that resolves this vulnerability.Fixed in 0.26.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A user must be able to authenticate, have the global owner value obtained by creating a group, and also be a member of a different group. They can then target that other group by setting the X-Tenant request header.
What is the impact of a successful exploit?
The attacker can permanently delete the complete inventory of the selected group through the wipe-inventory action. Recovery is not possible without external backups.
Which versions are affected and what is the remediation?
HomeBox versions prior to 0.26.0 are affected. Upgrade to version 0.26.0, which fixes the authorization flaw.
What can be done if upgrading is not immediately possible?
The provided information identifies external backups as necessary to recover from a wipe. Ensure backups exist for group inventories and restrict membership of users who may have created their own groups until the fix is deployed.