Medium severity · published Sep 21, 2026
CVE-2026-48974
HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring an owner role, an invitation token, target-user consent, or target-user notification. Any authenticated user can force another account into the caller's group, disclose the target user's email address and name through the resulting member list, and create the membership prerequisite used by a separate cross-group inventory-wipe vulnerability. This issue is fixed in version 0.26.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HO
homebox · sysadminsmedia
< 0.26.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-48974
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-48974
x_refsource_CONFIRM
https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-ffcw-whqh-hgqf
x_refsource_MISC
https://github.com/sysadminsmedia/homebox/commit/ed3216a80998dfd81d4418700696244144883160
x_refsource_MISC
https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0
More from homebox
8.1
CVE-2026-48826
HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching
8.1
CVE-2026-48975
HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox
8.1
CVE-2026-48976
HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack
8.1
CVE-2026-40196
HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation
7.4
CVE-2026-27981
HomeBox has an Auth Rate Limit Bypass via IP Spoofing