CVE-2026-48826 in Homebox
Summary
by MITRE • 09/21/2026
HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1/v1_ctrl_actions.go authorizes POST /v1/actions/wipe-inventory through the global ctx.User.IsOwner value instead of the caller's role in the active group, while the active group is selected through the X-Tenant request header. Because every self-registered user who creates a group receives the global owner value, a user who is also a member of another group can select that group with X-Tenant and permanently delete its complete inventory, which is not recoverable without external backups. This issue is fixed in version 0.26.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in HomeBox versions prior to 0.26.0 represents a critical authorization flaw rooted in the improper enforcement of access control policies within the application's backend logic. Specifically, the HandleWipeInventory function, which processes POST requests to the /v1/actions/wipe-inventory endpoint, relies on an incorrect security context for determining user permissions. Instead of evaluating the caller's specific role and privileges within the currently active group, the system checks a global ctx.User.IsOwner flag. This architectural decision creates a significant discrepancy between the intended access control model based on multi-tenant group isolation and the actual implementation that grants broad administrative powers to any user marked as an owner in their primary context.
The operational mechanism of this vulnerability is facilitated by the application's use of the X-Tenant request header to select the active group for data operations. When a self-registered user creates a new inventory group, they are automatically assigned the global IsOwner value within that specific context. However, because many users may belong to multiple groups or have created their own primary group while being invited as members into others, this design allows for cross-group privilege escalation. An attacker who is merely a member of one group can manipulate the X-Tenant header to target a different group where they do not hold administrative privileges but which contains valuable inventory data. By sending a POST request with the targeted tenant ID and leveraging their global owner status from another context, the application erroneously authorizes the wipe operation.
The impact of this vulnerability is severe due to the destructive nature of the affected action. The wipe-inventory endpoint permanently deletes all items within the specified group's inventory without providing any mechanism for recovery other than external backups that may not exist or be up-to-date. This results in a complete loss of data integrity and availability for the targeted group. For users managing household assets, financial records, or sensitive personal information through HomeBox, this constitutes a catastrophic failure of confidentiality and availability principles. The lack of granular role-based access control means that any user with at least one owner-level account can potentially destroy the data of other groups they are associated with, undermining trust in the platform's multi-tenant isolation capabilities.
To mitigate this vulnerability, immediate action is required to upgrade HomeBox to version 0.26.0 or later, where the authorization logic has been corrected to properly validate the caller's role within the specific active group selected via the X-Tenant header. Until an upgrade can be performed, administrators should consider restricting access to the wipe-inventory endpoint through network-level controls if possible, although this is not a comprehensive solution given that legitimate users also require API access. Furthermore, implementing regular and isolated backups of inventory data is essential to ensure recoverability in the event of accidental or malicious deletion. From a standards perspective, this flaw aligns with CWE-862 Missing Authorization, as the application failed to enforce proper authorization checks for specific resources. It also relates to CWE-269 Improper Privilege Management due to the reliance on global flags rather than context-specific roles. In terms of attack vectors, this vulnerability can be exploited via ATT&CK technique T1485 Data Destruction, where an adversary deletes data or manipulates it in a way that renders it unusable for its intended purpose.