CVE-2026-48975: HomeBox Privilege Escalation Vulnerability

CVE-2026-48975 Overview

HomeBox is an open-source home inventory and organization system. Versions prior to 0.26.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the maintenance entry repository. The MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete functions in backend/internal/data/repo/repo_maintenance_entry.go call UpdateOneID(id) and DeleteOneID(id) without verifying that the target maintenance entry belongs to the authenticated user's active group. An authenticated low-privileged tenant who knows or enumerates another tenant's maintenance-entry UUID can overwrite or permanently delete that record. The issue is tracked under [CWE-639: Authorization Bypass Through User-Controlled Key] and resolved in version 0.26.0.

Critical Impact
Any authenticated HomeBox user can modify or delete maintenance entries belonging to other tenants by supplying a target UUID, breaking multi-tenant isolation.

Affected Products

HomeBox versions prior to 0.26.0
backend/internal/data/repo/repo_maintenance_entry.go component
Multi-tenant HomeBox deployments serving more than one group

Discovery Timeline

2026-09-21 - CVE-2026-48975 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-48975

Vulnerability Analysis

HomeBox enforces tenant isolation by scoping records to a group associated with the authenticated user. The maintenance entry repository violates this model by performing update and delete operations keyed only on the record UUID supplied by the caller. Because the entry's group_id is never compared against the caller's active group, the database layer trusts the identifier without an authorization check. An authenticated user with any role can therefore reach across tenant boundaries by supplying another group's UUID. The result is a horizontal privilege escalation that affects data integrity and availability while leaving confidentiality intact, matching the CWE-639 pattern of authorization bypass through user-controlled keys.

Root Cause

The root cause is missing authorization enforcement in the data access layer. The Update and Delete methods build queries via UpdateOneID(id) and DeleteOneID(id) from the Ent ORM without chaining a Where(maintenanceentry.HasGroupWith(...)) predicate. The service layer above assumes the repository validates ownership, and the repository assumes the service layer does. Neither performs the check, leaving the endpoint open to any authenticated caller.

Attack Vector

Exploitation requires network access to the HomeBox API and a valid low-privileged account. The attacker enumerates or otherwise obtains a maintenance-entry UUID belonging to another group. They then issue an authenticated PUT or DELETE request against the maintenance entry endpoint, passing the target UUID in the path. The backend executes the operation against the foreign record without verifying group membership.

// Patch context from the same repository commit — group-scoped authorization
// is now enforced instead of trusting a raw UUID lookup.
ctx := services.NewContext(r.Context())

isOwner, err := ctrl.repo.Groups.IsOwnerOf(ctx, ctx.UID, ctx.GID)
if err != nil {
    return validate.NewRequestError(err, http.StatusInternalServerError)
}
if !isOwner {
    return validate.NewRequestError(errors.New("only group owners can wipe inventory"), http.StatusForbidden)
}

Source: GitHub Commit ed3216a

Detection Methods for CVE-2026-48975

Indicators of Compromise

Unexpected PUT or DELETE requests to /api/v1/items/*/maintenance/* endpoints originating from user accounts that do not own the referenced item or group.
Audit-log gaps or sudden disappearance of maintenance entries reported by tenants who did not initiate the change.
Sequential or high-volume UUID enumeration attempts against maintenance entry routes from a single authenticated session.

Detection Strategies

Correlate application access logs with the group_id of the affected maintenance record and alert when the acting user's group does not match.
Instrument the HomeBox reverse proxy to log the authenticated user identifier alongside the maintenance entry UUID for every state-changing request.
Baseline normal maintenance-entry write volume per user and flag deviations that suggest cross-tenant tampering.

Monitoring Recommendations

Ship HomeBox backend logs to a centralized log platform and retain full HTTP method, path, user ID, and response code for API calls under /api/v1/items/.
Enable database-level auditing on the maintenance_entries table to capture update and delete statements with the calling application context.
Review group membership changes and administrative actions on a recurring cadence to detect follow-on tampering.

How to Mitigate CVE-2026-48975

Immediate Actions Required

Upgrade HomeBox to version 0.26.0 or later, which introduces group-scoped authorization checks in the maintenance entry repository.
Rotate API tokens and session credentials issued to shared or multi-tenant HomeBox instances after upgrading.
Audit maintenance entries created, modified, or deleted before the upgrade to identify tampered records.

Patch Information

The fix is included in the HomeBox v0.26.0 release. The remediation commit is available at GitHub commit ed3216a, and the vendor advisory is published as GHSA-7mr6-2wxw-27j9. The patched repository methods now constrain queries to the caller's active group before applying updates or deletions.

Workarounds

Restrict HomeBox access to a single trusted group by disabling self-service registration and manually provisioning users until the upgrade is applied.
Place the HomeBox API behind an authenticating reverse proxy that validates the requested resource path against the caller's group claim.
Take a full database backup before upgrading so tampered maintenance entries can be restored if abuse is discovered post-upgrade.

bash

# Upgrade example for Docker deployments
docker pull ghcr.io/sysadminsmedia/homebox:v0.26.0
docker stop homebox && docker rm homebox
docker run -d --name homebox \
  -v /path/to/homebox/data:/data \
  -p 3100:7745 \
  ghcr.io/sysadminsmedia/homebox:v0.26.0