CVE-2026-40196: HomeBox Auth Bypass Vulnerability

CVE-2026-40196 Overview

CVE-2026-40196 is an authorization bypass vulnerability in HomeBox, a home inventory and organization system. The vulnerability exists in versions prior to 0.25.0 where the defaultGroup ID remains permanently assigned to a user after being invited to a group, even after their access to that group is revoked. While the web interface correctly enforces access revocation and prevents the user from viewing or modifying the group's contents, the API does not properly validate permissions, allowing continued unauthorized access.

Critical Impact

Users with revoked group access can continue to perform full CRUD (Create, Read, Update, Delete) operations on the group's collections through the API, completely bypassing intended access controls.

Affected Products

• HomeBox versions prior to 0.25.0

Discovery Timeline

• April 17, 2026 - CVE-2026-40196 published to NVD
• April 20, 2026 - Last updated in NVD database

Technical Details for CVE-2026-40196

Vulnerability Analysis

This authorization bypass vulnerability (CWE-708: Incorrect Ownership Assignment) occurs due to improper validation of the defaultGroup field when processing API requests. The core issue stems from a disconnect between the web interface's access control enforcement and the API's permission validation logic.

When a user is invited to a group in HomeBox, the system assigns that group's ID as the user's defaultGroup. Under normal operation, this facilitates seamless access to the group's inventory collections. However, when an administrator revokes the user's access to the group, the system fails to clear or update this defaultGroup assignment.

The vulnerability is particularly dangerous because it creates a persistent authorization state that survives explicit access revocation. The API layer uses the X-Tenant header to determine group context, but when this header is omitted, the system falls back to using the defaultGroup value without validating whether the user still has legitimate access to that group.

Root Cause

The root cause lies in the inconsistent handling of access revocation between the web interface and API layers. When group access is revoked, the web interface correctly enforces the revocation at the presentation layer, but the underlying data model retains the defaultGroup assignment. The API's fallback mechanism that uses defaultGroup when the X-Tenant header is absent does not include a secondary authorization check to verify current access permissions.

Attack Vector

This vulnerability is exploitable over the network by any authenticated user who previously had legitimate access to a group. The attack requires low privileges (only authenticated access) and can be executed without user interaction.

An attacker who was previously granted access to a group and subsequently had that access revoked can exploit this vulnerability by:

1. Making direct API requests without the X-Tenant header
2. The API falls back to using the attacker's defaultGroup value
3. Since no permission re-validation occurs, the attacker gains full CRUD access to the group's collections

The exploitation method involves crafting API requests that omit the X-Tenant header, causing the backend to default to the persisted defaultGroup value. This allows the attacker to read sensitive inventory data, modify existing items, create new entries, or delete items from groups they should no longer have access to.

Detection Methods for CVE-2026-40196

Indicators of Compromise

• API requests to group-specific endpoints that lack the X-Tenant header from users with revoked group permissions
• Successful API operations performed on groups by users not currently listed as group members
• Audit log entries showing data modifications from users who were previously removed from groups
• Unusual patterns of API access that bypass the web interface

Detection Strategies

• Monitor API access logs for requests missing the X-Tenant header that result in successful group operations
• Cross-reference API activity with current group membership lists to identify unauthorized access
• Implement alerts for CRUD operations on group collections from users not in the active member list
• Review audit trails for any data access or modifications following access revocation events

Monitoring Recommendations

• Enable comprehensive API request logging including header analysis
• Set up automated alerts for API requests that omit the X-Tenant header
• Conduct periodic audits comparing defaultGroup assignments against current group membership
• Monitor for patterns of API-only access that circumvents web interface controls

How to Mitigate CVE-2026-40196

Immediate Actions Required

• Upgrade HomeBox to version 0.25.0 or later immediately
• Audit all recent API access logs for potential exploitation by formerly authorized users
• Review and verify current group memberships against recent access revocation actions
• Consider temporarily restricting API access if immediate upgrade is not possible

Patch Information

The vulnerability has been addressed in HomeBox version 0.25.0. The fix ensures proper validation of group access permissions regardless of the defaultGroup assignment, and correctly clears or updates the defaultGroup value when access is revoked.

For detailed patch information, see the GitHub HomeBox Release v0.25.0 and the GitHub Security Advisory GHSA-6pvm-v73p-p6m9.

Workarounds

• If upgrading is not immediately possible, manually clear the defaultGroup field for any users whose group access has been revoked
• Implement API gateway rules to require the X-Tenant header on all group-related API endpoints
• Restrict API access to trusted networks or implement additional authentication layers
• Monitor and audit all API requests for suspicious activity until the patch can be applied

# After upgrading to v0.25.0, verify the version
homebox --version
# Expected output: 0.25.0 or higher

# Review group memberships and defaultGroup assignments
# Consult HomeBox documentation for database inspection commands