Description

HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1/v1_ctrl_actions.go authorizes POST /v1/actions/wipe-inventory through the global ctx.User.IsOwner value instead of the caller's role in the active group, while the active group is selected through the X-Tenant request header. Because every self-registered user who creates a group receives the global owner value, a user who is also a member of another group can select that group with X-Tenant and permanently delete its complete inventory, which is not recoverable without external backups. This issue is fixed in version 0.26.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-21T18:17:08.073Z",
  "pubdate": "2026-09-21T18:17:08.073Z",
  "executiveSummary": "A critical Broken Access Control vulnerability exists in HomeBox versions prior to 0.26.0, specifically within the inventory management subsystem. The vulnerability is characterized by improper authorization logic where the application validates destructive actions against global user privileges rather than tenant-specific group permissions.\nThe vulnerability resides in the HandleWipeInventory function, which processes inventory deletion requests. Due to an incorrect implementation of authorization checks, a user with global owner status—automatically granted upon the creation of their own group—can execute the wipe inventory command against any arbitrary group they belong to, even if they lack administrative rights within that specific target tenant context.\nThis flaw allows an authenticated attacker to perform a destructive operation, resulting in permanent, non-recoverable data loss for any group they are a member of. The risk is high, as the exploitation requirement is minimal: the attacker must only be a member of the target group and possess the ability to manipulate the X-Tenant request header. There is no recovery mechanism for the wiped inventory, posing a significant risk to data integrity and availability for multi-user deployments of HomeBox.",
  "technicalDetails": "The vulnerability is located in backend/app/api/handlers/v1/v1_ctrl_actions.go within the HandleWipeInventory function. The root cause is a flaw in the authorization logic used to validate the POST /v1/actions/wipe-inventory request. The application relies on the ctx.User.IsOwner attribute, which represents a global state, to authorize the request rather than validating the user's role against the specific group context defined in the X-Tenant header.\nIn the HomeBox architecture, users who register and create their own group are assigned the global IsOwner flag. When a user authenticates, this global flag is checked to determine authorization for sensitive actions. However, the system fails to verify if the user possesses the 'Owner' role specifically within the group identified by the X-Tenant request header. Because the authorization check is performed globally, any user with the IsOwner status effectively bypasses the scoping constraints intended for multi-tenant environments.\nThe attack flow proceeds as follows: First, an authenticated attacker identifies a target group they are a member of. Second, the attacker crafts a POST request to /v1/actions/wipe-inventory. Third, the attacker includes the X-Tenant header in the HTTP request, specifying the target group's identifier. Fourth, the backend processes the request and checks the global ctx.User.IsOwner value. Because the attacker is an owner of their own primary group, the global check returns true for all other groups they are a member of. Consequently, the backend executes the wipe command, permanently deleting all inventory records associated with the target X-Tenant group.\nThis vulnerability is present in all versions prior to 0.26.0. It requires a valid user session but does not require administrative privileges within the victim's tenant. The lack of group-based access control validation during the handling of the wipe request allows for unauthorized, permanent data destruction, which cannot be recovered without external backups."
}