Description

HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring an owner role, an invitation token, target-user consent, or target-user notification. Any authenticated user can force another account into the caller's group, disclose the target user's email address and name through the resulting member list, and create the membership prerequisite used by a separate cross-group inventory-wipe vulnerability. This issue is fixed in version 0.26.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-21T18:17:08.240Z",
  "pubdate": "2026-09-21T18:17:08.240Z",
  "executiveSummary": "HomeBox versions prior to 0.26.0 contain an insecure direct object reference and insufficient authorization vulnerability within the group management functionality.\nThe vulnerability allows any authenticated user to force-add other registered users into arbitrary groups without consent, invitation tokens, or administrative oversight.\nThis flaw facilitates unauthorized data disclosure, specifically exposing the target user's name and email address through the group member list.\nFurthermore, it serves as a critical prerequisite for an additional cross-group inventory-wipe attack, enabling cross-tenant service disruption.\nThe risk is categorized as high, as it bypasses standard authorization controls and user consent mechanisms, allowing malicious actors to map user relationships and manipulate application state without verification.",
  "technicalDetails": "The vulnerability resides in the implementation of the POST /v1/groups/members endpoint, which invokes the HandleGroupMemberAdd function and subsequently triggers GroupService.AddMember.\nThe root cause is a failure to enforce rigorous access control checks during the member addition process. The application accepts a caller-supplied userID and processes the inclusion of the target user into the target group without validating if the requester holds an owner role or possesses a valid invitation token.\nThe vulnerability is exposed because the back-end service does not verify the relationship between the authenticated requester and the target user, nor does it mandate target-user consent or notification. By sending a crafted POST request to the identified endpoint, an attacker can supply the target's userID, which the system then maps into the attacker's group database records.\nThe attack flow follows a predictable sequence: First, the attacker authenticates as a legitimate user within the system. Second, the attacker identifies a target userID, which can be enumerated through various side channels or application behavior. Third, the attacker transmits a request to POST /v1/groups/members with the target userID. The server-side logic fails to gate this request, resulting in the target being successfully added to the group.\nThe post-exploitation impact includes information disclosure, as the victim's name and email address become visible in the group member list immediately upon successful injection. Additionally, this vulnerability creates a functional membership link between the attacker and the victim, which is a required prerequisite for executing a secondary cross-group inventory-wipe vulnerability. This allows the attacker to move beyond simple information disclosure into active data destruction or service compromise. The vulnerable logic is pervasive in versions prior to 0.26.0 and requires no special administrative privileges, only valid user authentication."
}