CVE-2026-48974: HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler
HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring an owner role, an invitation token, target-user consent, or target-user notification. Any authenticated user can force another account into the caller's group, disclose the target user's email address and name through the resulting member list, and create the membership prerequisite used by a separate cross-group inventory-wipe vulnerability. This issue is fixed in version 0.26.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HomeBoxto a version that resolves this vulnerability.Fixed in 0.26.0
Event History
Frequently Asked Questions
Who can exploit this issue, and what access do they need?
Any authenticated HomeBox user can exploit it. The attacker only needs to submit a request to the group-member addition endpoint with another account's user ID; owner privileges, an invitation token, and the target user's consent are not required.
What information or impact can result from exploitation?
An attacker can force a target account into the attacker's group and then obtain the target user's email address and name from the resulting member list. The unauthorized membership can also satisfy a prerequisite for a separate cross-group inventory-wipe vulnerability.
Are users protected by default from unwanted group additions?
No. In affected versions, the add-member handler does not require an owner role, invitation token, target-user consent, or target-user notification.
How can I determine whether my deployment is affected?
HomeBox versions earlier than 0.26.0 are affected. Review group membership changes for accounts added without consent, particularly where the adding user was not a group owner or no invitation process was used.
What should I do if I cannot upgrade immediately?
The provided information identifies version 0.26.0 as the fix but does not specify a workaround. Until upgrading, treat authenticated users as able to add arbitrary accounts to their groups and monitor or restrict access to the affected endpoint where possible.