CVE-2026-48826: HomeBox Authorization Bypass Vulnerability

CVE-2026-48826 Overview

HomeBox is a self-hosted home inventory and organization system. Versions prior to 0.26.0 contain a broken access control flaw in the HandleWipeInventory function located in backend/app/api/handlers/v1/v1_ctrl_actions.go. The handler for POST /v1/actions/wipe-inventory authorizes the caller using the global ctx.User.IsOwner value instead of validating the user's role within the active group. Because the active group is chosen through the X-Tenant request header, any self-registered user who has created their own group carries the global owner flag and can wipe the inventory of any other group they belong to. The deletion is permanent and unrecoverable without external backups. Version 0.26.0 fixes the issue.

Critical Impact

A low-privileged group member can permanently delete another group's entire inventory by manipulating the X-Tenant header, with no recovery path outside external backups.

Affected Products

• HomeBox versions prior to 0.26.0
• sysadminsmedia/homebox self-hosted deployments
• Multi-group HomeBox installations with self-registration enabled

Discovery Timeline

• 2026-09-21 - CVE-2026-48826 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-48826

Vulnerability Analysis

The vulnerability is a broken access control flaw classified as [CWE-269] Improper Privilege Management. HomeBox supports multi-tenant grouping, where users can belong to multiple groups and switch between them using the X-Tenant HTTP header. Every self-registered user who creates their own group is assigned an owner role, and this role is persisted on the user object as ctx.User.IsOwner. The wipe-inventory endpoint checked only this global flag rather than the caller's role in the currently selected group. As a result, group ownership scope was effectively global from the perspective of this handler.

Root Cause

The HandleWipeInventory handler in backend/app/api/handlers/v1/v1_ctrl_actions.go used ctx.User.IsOwner as its authorization check. This field reflects whether the user is an owner of any group they created, not whether they own the group referenced by the current request context. The active group identifier (ctx.GID) is derived from the X-Tenant header, so authorization and tenancy were resolved from independent sources without cross-validation.

Attack Vector

An authenticated user first self-registers, which grants the global owner attribute. They then join a second group as a regular member, either through an invitation or existing membership. By issuing a POST /v1/actions/wipe-inventory request with the X-Tenant header set to the target group's identifier, the handler passes the IsOwner check and executes an irreversible inventory wipe against the victim group.

// Patched authorization in backend/app/api/handlers/v1/v1_ctrl_actions.go
ctx := services.NewContext(r.Context())

// Before: relied on the global user flag
// if !ctx.User.IsOwner {

// After: validates ownership of the active group (ctx.GID)
isOwner, err := ctrl.repo.Groups.IsOwnerOf(ctx, ctx.UID, ctx.GID)
if err != nil {
    return validate.NewRequestError(err, http.StatusInternalServerError)
}
if !isOwner {
    return validate.NewRequestError(errors.New("only group owners can wipe inventory"), http.StatusForbidden)
}

Source: GitHub commit ed3216a

Detection Methods for CVE-2026-48826

Indicators of Compromise

• Unexpected POST /v1/actions/wipe-inventory requests in HomeBox access logs
• Requests to the wipe endpoint where the X-Tenant header does not match the caller's primary group
• Sudden disappearance of items, labels, or locations from a group with no corresponding administrative action
• Requests to the wipe endpoint from user accounts that are not the original creator of the affected group

Detection Strategies

• Enable HTTP access logging for the HomeBox backend and alert on any request to /v1/actions/wipe-inventory
• Correlate the authenticated user ID with the X-Tenant value and flag mismatches where the user is not the group owner
• Monitor database change volumes for large-scale deletions of inventory rows within short time windows

Monitoring Recommendations

• Forward reverse-proxy or application logs to a central SIEM and build a detection for calls to the wipe endpoint
• Track HomeBox version strings across deployments and alert on any instance still running a release earlier than 0.26.0
• Review audit trails for group membership changes preceding wipe requests to detect abuse of invitation flows

How to Mitigate CVE-2026-48826

Immediate Actions Required

• Upgrade HomeBox to version 0.26.0 or later without delay
• Verify integrity of recent backups and confirm restore procedures work end-to-end before continued use
• Audit group membership lists and remove any users who should not have access to shared inventories
• Temporarily disable self-registration on internet-exposed HomeBox instances until patched

Patch Information

The fix is delivered in HomeBox release v0.26.0. The patched handler calls ctrl.repo.Groups.IsOwnerOf(ctx, ctx.UID, ctx.GID) to verify that the caller owns the group referenced by the active tenant context before permitting the wipe. See the GHSA-559j-7w3w-4fr7 advisory for the full vendor writeup.

Workarounds

• Block POST /v1/actions/wipe-inventory at a reverse proxy such as Nginx, Traefik, or Caddy until the upgrade is applied
• Restrict HomeBox access to trusted users only and disable public self-registration
• Maintain frequent external backups of the HomeBox database so a malicious wipe can be reversed

# Example Nginx block for the vulnerable endpoint
location = /v1/actions/wipe-inventory {
    return 403;
}