Vulnerability Description
HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring an owner role, an invitation token, target-user consent, or target-user notification. Any authenticated user can force another account into the caller's group, disclose the target user's email address and name through the resulting member list, and create the membership prerequisite used by a separate cross-group inventory-wipe vulnerability. This issue is fixed in version 0.26.0.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/sysadminsmedia/homebox/commit/ed3216a80998dfd81d4418700696244
- https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0
- https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-ffcw-whqh-hgq
FAQ
What is CVE-2026-48974?
CVE-2026-48974 is a vulnerability with a CVSS score of 5.4 (MEDIUM). HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring a...
How severe is CVE-2026-48974?
CVE-2026-48974 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-48974?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.