CVE-2026-48974: falha de média gravidade em sysadminsmedia homebox
HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.3%
HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring an owner role, an invitation token, target-user consent, or target-user notification. Any authenticated user can force another account into the caller's group, disclose the target user's email address and name through the resulting member list, and create the membership prerequisite used by a separate cross-group inventory-wipe vulnerability. This issue is fixed in version 0.26.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Produtos afetados
sysadminsmedia · homeboxCVEs relacionadas — sysadminsmedia homebox
No mesmo produto, das mais perigosas para as menos.
CVE-2026-48826HIGHHomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header SwitchingEPSS 0.5%CVE-2026-48975HIGHHomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in HomeboxEPSS 0.5%CVE-2026-48976HIGHHomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook HijackEPSS 0.4%CVE-2026-55473MEDIUMHomeBox: Notifier SSRF guard misses NAT64 prefixes (64:ff9b::/96, 64:ff9b:1::/48) — generic:// URL reaches cloud metadata on NAT64 egressEPSS 0.4%CVE-2025-53108MEDIUMHomeBox Missing User AuthorizationEPSS 0.3%CVE-2026-27981HIGHHomeBox has an Auth Rate Limit Bypass via IP SpoofingEPSS 0.3%