CVE-2026-48975: falha de alta gravidade em sysadminsmedia homebox
HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.1epss 0.5%
HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repo_maintenance_entry.go use UpdateOneID(id) and DeleteOneID(id) without verifying that the maintenance entry belongs to the authenticated user's active group. An authenticated low-privileged user who knows or enumerates another tenant's maintenance-entry UUID can overwrite that record or permanently delete it. This issue is fixed in version 0.26.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Produtos afetados
sysadminsmedia · homeboxCVEs relacionadas — sysadminsmedia homebox
No mesmo produto, das mais perigosas para as menos.
CVE-2026-48826HIGHHomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header SwitchingEPSS 0.5%CVE-2026-48976HIGHHomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook HijackEPSS 0.4%CVE-2026-55473MEDIUMHomeBox: Notifier SSRF guard misses NAT64 prefixes (64:ff9b::/96, 64:ff9b:1::/48) — generic:// URL reaches cloud metadata on NAT64 egressEPSS 0.4%CVE-2025-53108MEDIUMHomeBox Missing User AuthorizationEPSS 0.3%CVE-2026-27981HIGHHomeBox has an Auth Rate Limit Bypass via IP SpoofingEPSS 0.3%CVE-2026-48974MEDIUMHomeBox: Forced Group Membership Without Consent in Homebox AddMember HandlerEPSS 0.3%