{"id":"CVE-2026-48974","published":"2026-09-21T18:17:08.240","lastModified":"2026-09-21T18:17:08.240","description":"HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring an owner role, an invitation token, target-user consent, or target-user notification. Any authenticated user can force another account into the caller's group, disclose the target user's email address and name through the resulting member list, and create the membership prerequisite used by a separate cross-group inventory-wipe vulnerability. This issue is fixed in version 0.26.0.","cvssScore":5.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cwes":["CWE-841","CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/sysadminsmedia/homebox/commit/ed3216a80998dfd81d4418700696244144883160","tags":[]},{"url":"https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0","tags":[]},{"url":"https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-ffcw-whqh-hgqf","tags":[]}],"exploitRefs":[{"url":"https://github.com/sysadminsmedia/homebox/commit/ed3216a80998dfd81d4418700696244144883160","tags":[]},{"url":"https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0","tags":[]},{"url":"https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-ffcw-whqh-hgqf","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows any authenticated user to add another account to their group without proper authorization, leading to potential unauthorized access and data exposure.","exploitability":"Exploitation is relatively easy as it requires only an authenticated session with minimal interaction from the target user.","blast_radius":"If exploited, this could lead to significant privacy breaches and control over shared resources within the HomeBox system.","remediation":"Upgrade to version 0.26.0 or later to apply the necessary security fixes.","tags":["auth-bypass","data-exposure","web"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-22T06:25:46.209Z"}}