Medium severity · published Jul 2, 2025
CVE-2025-53108
HomeBox Missing User Authorization
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
HomeBox is a home inventory and organization system. Prior to 0.20.1, HomeBox contains a missing authorization check in the API endpoints responsible for updating and deleting inventory item attachments. This flaw allows authenticated users to perform unauthorized actions on inventory item attachments that they do not own. This issue could lead to unauthorized data manipulation or loss of critical inventory data. This issue has been patched in version 0.20.1. There are no workarounds, users must upgrade.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HO
homebox · sysadminsmedia
< 0.20.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-53108
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-53108
github.com
https://github.com/sysadminsmedia/homebox/commit/e159dd8a0b5d01d7225795bfba5634781181df20
github.com
https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-m6vx-pg9q-vq6m
More from homebox
8.1
CVE-2026-48826
HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching
8.1
CVE-2026-48975
HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox
8.1
CVE-2026-48976
HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack
8.1
CVE-2026-40196
HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation
7.4
CVE-2026-27981
HomeBox has an Auth Rate Limit Bypass via IP Spoofing