CVE-2025-53108: HomeBox Authorization Bypass Vulnerability

CVE-2025-53108 Overview

HomeBox is a self-hosted home inventory and organization system. Versions prior to 0.20.1 contain a missing authorization check [CWE-862] in the API endpoints responsible for updating and deleting inventory item attachments. Authenticated users can perform unauthorized actions on attachments belonging to other users or groups. The flaw enables cross-tenant data manipulation and potential loss of inventory data. The maintainers patched the issue in version 0.20.1, and no workarounds exist outside of upgrading.

Critical Impact

Any authenticated HomeBox user can update, rename, or delete inventory item attachments owned by other groups, resulting in unauthorized data manipulation or loss.

Affected Products

• HomeBox (sysadminsmedia/homebox) versions prior to 0.20.1
• Backend API handler v1_ctrl_items_attachments.go
• Item attachment service service_items_attachments.go

Discovery Timeline

• 2025-07-02 - CVE-2025-53108 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53108

Vulnerability Analysis

HomeBox exposes REST endpoints that allow authenticated users to retrieve, update, rename, and delete file attachments associated with inventory items. Before 0.20.1, these endpoints resolved attachments by attachmentID alone without validating that the attachment belonged to the caller's group. The service layer accepted an attachmentID and returned or mutated the record regardless of the requesting user's group identifier (GID). An attacker with a valid HomeBox account could enumerate or guess UUIDs and issue update or delete requests against attachments owned by unrelated groups. The result is a horizontal privilege escalation affecting the confidentiality and integrity of inventory attachment data.

Root Cause

The underlying issue is a missing authorization check [CWE-862]. Repository and service functions such as AttachmentPath, AttachmentUpdate, and Rename did not scope database lookups by the group identifier. Authorization was implicitly assumed from authentication, violating the principle that every object access must be verified against the caller's tenant context.

Attack Vector

Exploitation requires a valid authenticated session and network access to the HomeBox API. The attacker submits PUT or DELETE requests to the item attachment endpoints, supplying an attachmentID that belongs to another group. The server processes the request without a group ownership check and applies the change.

// Patch: backend/internal/core/services/service_items_attachments.go
// The service now requires a group ID (gid) and passes it to the repository
// so lookups and mutations are scoped to the caller's group.

-func (svc *ItemService) AttachmentPath(ctx context.Context, attachmentID uuid.UUID) (*ent.Attachment, error) {
-	attachment, err := svc.repo.Attachments.Get(ctx, attachmentID)
+func (svc *ItemService) AttachmentPath(ctx context.Context, gid uuid.UUID, attachmentID uuid.UUID) (*ent.Attachment, error) {
+	attachment, err := svc.repo.Attachments.Get(ctx, gid, attachmentID)
 	if err != nil {
 		return nil, err
 	}
 
 	return attachment, nil
 }

-func (svc *ItemService) AttachmentUpdate(ctx Context, itemID uuid.UUID, data *repo.ItemAttachmentUpdate) (repo.ItemOut, error) {
+func (svc *ItemService) AttachmentUpdate(ctx Context, gid uuid.UUID, itemID uuid.UUID, data *repo.ItemAttachmentUpdate) (repo.ItemOut, error) {
-	attachment, err := svc.repo.Attachments.Update(ctx, data.ID, data)
+	attachment, err := svc.repo.Attachments.Update(ctx, gid, data.ID, data)
 	if err != nil {
 		return repo.ItemOut{}, err
 	}

 	attDoc := attachment
-	_, err = svc.repo.Attachments.Rename(ctx, attDoc.ID, data.Title)
+	_, err = svc.repo.Attachments.Rename(ctx, gid, attDoc.ID, data.Title)
 	if err != nil {
 		return repo.ItemOut{}, err
 	}

Source: GitHub Commit e159dd8

Detection Methods for CVE-2025-53108

Indicators of Compromise

• Unexpected modifications, renames, or deletions of inventory item attachments in HomeBox audit logs or database records.
• API access log entries showing PUT or DELETE requests against /api/v1/items/{id}/attachments/{attachmentID} from accounts not associated with the target attachment's group.
• Sudden appearance of attachment titles or metadata inconsistent with the owning group's naming conventions.

Detection Strategies

• Review HomeBox reverse proxy or application logs for authenticated users repeatedly requesting attachment UUIDs across many items in short intervals.
• Correlate HTTP request paths containing /attachments/ with the requesting user's group membership to identify cross-group access attempts.
• Compare current attachment records against known-good backups to identify unauthorized mutations that predate the upgrade to 0.20.1.

Monitoring Recommendations

• Enable structured request logging on the HomeBox reverse proxy and forward logs to a central SIEM or data lake for retention.
• Alert on high-volume attachment mutation activity per user session, which is atypical for a home inventory workload.
• Track deployed HomeBox container image versions in configuration management to confirm all instances run 0.20.1 or later.

How to Mitigate CVE-2025-53108

Immediate Actions Required

• Upgrade all HomeBox instances to version 0.20.1 or later immediately.
• Audit existing inventory attachments for unauthorized modifications and restore from backups where necessary.
• Rotate HomeBox user credentials and API tokens if you operate a multi-user deployment with untrusted accounts.

Patch Information

The fix is delivered in HomeBox 0.20.1 via commit e159dd8a0b5d01d7225795bfba5634781181df20. The patch adds a gid uuid.UUID parameter to the attachment service and repository functions, forcing every attachment lookup, update, and rename operation to be scoped to the caller's group. Additional context is available in the GitHub Security Advisory GHSA-m6vx-pg9q-vq6m.

Workarounds

• No workarounds are available. Upgrading to 0.20.1 is the only supported remediation per the vendor advisory.
• As a defense-in-depth measure until upgrade, restrict HomeBox access to trusted users only via network controls or reverse proxy authentication.

# Upgrade HomeBox via Docker Compose
docker compose pull homebox
docker compose up -d homebox

# Verify the running version is 0.20.1 or later
docker exec homebox /app/api --version