CVE-2026-48975: HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox
HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repomaintenanceentry.go use UpdateOneID(id) and DeleteOneID(id) without verifying that the maintenance entry belongs to the authenticated user's active group. An authenticated low-privileged user who knows or enumerates another tenant's maintenance-entry UUID can overwrite that record or permanently delete it. This issue is fixed in version 0.26.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HomeBoxto a version that resolves this vulnerability.Fixed in 0.26.0
Event History
Frequently Asked Questions
Which deployments are affected?
HomeBox deployments running versions prior to 0.26.0 are affected. The issue is fixed in version 0.26.0.
What does an attacker need to exploit this issue?
An attacker needs an authenticated low-privileged HomeBox account and the UUID of a maintenance entry belonging to another tenant. The UUID may be known or enumerated.
Are maintenance records only exposed for viewing, or can they be changed?
An attacker can overwrite another tenant's maintenance entry or permanently delete it. The vulnerability affects update and delete operations.
What should teams do to remediate the issue?
Upgrade HomeBox to version 0.26.0, which fixes the missing active-group ownership verification for maintenance-entry updates and deletions.