HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation

HomeBox allowed users to keep accessing a group's data through its API even after their access was revoked, because the system forgot to remove their default group assignment. This means someone could still read, modify, and delete items in a group they were supposed to be locked out of.

The vulnerability exists in HomeBox's API validation logic where the defaultGroup ID persists in user sessions after group access revocation. When the X-Tenant header is omitted from API requests, the system falls back to this stale defaultGroup value without re-validating authorization, allowing authenticated users to perform CRUD operations on groups from which their access was revoked. The web interface properly enforces access controls, but the API lacks this validation, creating an authorization bypass.