PT-2026-33517 · Homebox · Homebox

Published 2026-04-17 · Updated 2026-04-21 · CVE-2026-40196

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions HomeBox versions prior to 0.25.0

Description An issue exists where the defaultGroup ID remains permanently assigned to a user after their access to a group is revoked. Although the web interface enforces this revocation, the API does not properly validate the defaultGroup value when the 'X-Tenant' header is omitted. This allows a user to perform full CRUD (Create, Read, Update, Delete) operations on the group's collections via the API, bypassing access controls.

Recommendations Update to version 0.25.0.

Fix

Weakness Enumeration

CWE-708

Related Identifiers

CVE-2026-40196

Affected Products

Homebox

References · 5

• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-6pvm-v73p-p6m9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40196 · Security Note
• https://github.com/sysadminsmedia/homebox/releases/tag/v0.25.0 · Note
• https://twitter.com/giuseppe_1337/status/2046397901065118036 · Twitter Post
• https://twitter.com/CVEnew/status/2045467391509836149 · Twitter Post