CVE-2026-48974: HomeBox Authentication Bypass Vulnerability

CVE-2026-48974 Overview

HomeBox is an open-source home inventory and organization system maintained by sysadminsmedia. Versions prior to 0.26.0 contain a broken access control flaw in the POST /v1/groups/members endpoint. The endpoint invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without validating that the caller is a group owner, without requiring an invitation token, and without target-user consent or notification. Any authenticated user can force another account into the caller's group. The attack exposes the target user's email and name through the resulting member list and creates the membership precondition for a separate cross-group inventory-wipe vulnerability.

Critical Impact

Any authenticated HomeBox user can silently add arbitrary accounts to their own group, disclosing user identity data and enabling downstream inventory tampering.

Affected Products

• HomeBox (sysadminsmedia/homebox) all versions prior to 0.26.0
• Self-hosted HomeBox deployments exposing the /v1/groups/members API
• HomeBox instances that permit self-registration of authenticated users

Discovery Timeline

• 2026-09-21 - CVE-2026-48974 published to the National Vulnerability Database
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-48974

Vulnerability Analysis

The flaw is an authorization bypass classified under [CWE-841] Improper Enforcement of Behavioral Workflow. The HandleGroupMemberAdd handler in the HomeBox backend accepts a GroupMemberAdd request body containing a target UserID field. The handler passes that identifier directly into GroupService.AddMember without verifying the caller's role or requiring a prior invitation acceptance. As a result, the group membership workflow — which is intended to require an owner-issued invitation token and target-user acceptance — can be short-circuited by any authenticated user issuing a single POST request.

Once membership is established, the victim account appears in the attacker-controlled group's member list, disclosing the victim's email address and display name. The forced membership also satisfies the preconditions for a separate cross-group inventory-wipe issue patched in the same release, allowing an attacker to escalate impact beyond information disclosure.

Root Cause

The root cause is the presence of a public AddMember code path that trusted caller-supplied input for the target user identity. The handler lacked both a role check (IsOwner) and a workflow gate requiring an invitation token or target consent. A related handler for inventory wiping relied on a stale ctx.User.IsOwner field rather than authoritatively querying the group ownership relationship.

Attack Vector

Exploitation requires only a valid authenticated session on the HomeBox instance. The attacker sends a POST request to /v1/groups/members with the victim's UUID in the userId field. No email confirmation, invitation token, or user interaction is required on the victim side. The victim receives no notification of the group change.

// Patch: removal of the abusable GroupMemberAdd request type
// Source: github.com/sysadminsmedia/homebox commit ed3216a

	GroupMemberAdd struct {
		UserID uuid.UUID `json:"userId" validate:"required"`
	}

The fix removes the GroupMemberAdd request struct entirely, eliminating the caller-supplied userID code path. A companion patch in v1_ctrl_actions.go replaces the stale ctx.User.IsOwner check with an authoritative lookup:

// Patch: authoritative owner lookup for inventory wipe
// Source: github.com/sysadminsmedia/homebox commit ed3216a

isOwner, err := ctrl.repo.Groups.IsOwnerOf(ctx, ctx.UID, ctx.GID)
if err != nil {
	return validate.NewRequestError(err, http.StatusInternalServerError)
}
if !isOwner {
	return validate.NewRequestError(errors.New("only group owners can wipe inventory"), http.StatusForbidden)
}

See the GitHub Security Advisory GHSA-ffcw-whqh-hgqf for the full disclosure.

Detection Methods for CVE-2026-48974

Indicators of Compromise

• HTTP POST requests to /v1/groups/members originating from non-owner authenticated sessions
• Group membership changes without a preceding POST /v1/groups/invitations and POST /v1/groups/invitations/{token}/accept sequence
• Unexpected user accounts appearing in group member listings alongside disclosure of their email addresses

Detection Strategies

• Review HomeBox application logs for HandleGroupMemberAdd invocations and correlate the calling user's role with the target group ownership
• Alert on group membership deltas that occur without an accompanying invitation acceptance event in the audit trail
• Baseline the ratio of invitation-based joins versus direct AddMember calls; any direct calls on unpatched versions indicate abuse

Monitoring Recommendations

• Enable verbose API request logging on the HomeBox reverse proxy and forward it to a centralized log store for retrospective analysis
• Monitor for enumeration patterns such as repeated /v1/users or /v1/groups/members calls that iterate through UUIDs
• Track database-level changes to the group_users join table and alert on inserts not tied to an invitation record

How to Mitigate CVE-2026-48974

Immediate Actions Required

• Upgrade all HomeBox deployments to version 0.26.0 or later without delay
• Audit current group membership rosters and remove any accounts that did not consent to their group assignment
• Rotate session tokens and reset credentials for any accounts observed exploiting the endpoint

Patch Information

The issue is fixed in HomeBox 0.26.0 via commit ed3216a80998dfd81d4418700696244144883160. The patch removes the GroupMemberAdd request handler entirely and replaces the stale IsOwner context check with an authoritative Groups.IsOwnerOf repository lookup for the inventory-wipe action. Release notes are published under GitHub Release v0.26.0, and the code change is available in the GitHub Commit Update.

Workarounds

• Restrict HomeBox to trusted users only by disabling self-registration until the upgrade is applied
• Block or filter POST /v1/groups/members at the reverse proxy layer for non-owner user sessions if immediate patching is not feasible
• Isolate the HomeBox instance behind an authenticating reverse proxy or VPN to reduce the pool of authenticated attackers

# Example nginx rule to block the vulnerable endpoint until patched
location = /v1/groups/members {
    if ($request_method = POST) {
        return 403;
    }
    proxy_pass http://homebox_backend;
}