Description

HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repo_maintenance_entry.go use UpdateOneID(id) and DeleteOneID(id) without verifying that the maintenance entry belongs to the authenticated user's active group. An authenticated low-privileged user who knows or enumerates another tenant's maintenance-entry UUID can overwrite that record or permanently delete it. This issue is fixed in version 0.26.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-21T18:17:08.410Z",
  "pubdate": "2026-09-21T18:17:08.410Z",
  "executiveSummary": "HomeBox versions prior to 0.26.0 are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability located within the maintenance entry management subsystem.\nThe vulnerability originates from a failure to enforce authorization checks during data modification and deletion operations. Specifically, the application does not validate that the target record resides within the authenticated user's active group boundary before executing database queries.\nThis flaw allows an authenticated low-privileged user to perform unauthorized write and delete operations on records belonging to other tenants by providing the corresponding UUID.\nThe impact is significant, as it permits unauthorized data destruction and modification, compromising the integrity and confidentiality of inventory data across multi-tenant environments.\nExploitation requires the attacker to possess an authenticated session and knowledge of the target's maintenance-entry UUID, which can be acquired via enumeration. The vulnerability is fully mitigated in version 0.26.0.",
  "technicalDetails": "The vulnerability exists in the backend/internal/data/repo/repo_maintenance_entry.go file, specifically within the MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete functions.\nThe root cause is an improper implementation of authorization logic where the repository layer utilizes the entity's UUID as the sole predicate for state-changing operations. Specifically, the functions invoke UpdateOneID(id) and DeleteOneID(id) without first cross-referencing the requested entity against the authenticated user's authorization context (i.e., their active group ID).\nIn a secure implementation, the repository should enforce a multi-tenant constraint by appending a group-level filter to the database query—for instance, WHERE id = ? AND group_id = ?. By omitting this constraint, the application effectively treats the UUID as a globally unique and trusted identifier, failing to implement the Principle of Least Privilege.\nThe attack flow follows a predictable pattern: 1) The attacker authenticates as a legitimate user within the HomeBox system. 2) The attacker identifies or enumerates the UUID of a target maintenance entry belonging to a different tenant. This is often achieved through side-channel information, observable URL patterns, or predictive UUID generation. 3) The attacker submits a crafted PUT or DELETE request to the API endpoint mapped to the affected repository functions, passing the discovered UUID. 4) The backend, lacking a tenant-scoping verification, executes the operation directly on the target record within the database.\nThe exploitation of this vulnerability results in arbitrary modification or deletion of data belonging to other users. Because the database interaction does not verify group membership, the backend service performs these operations with the privileges of the service account, granting the attacker the ability to overwrite inventory details or permanently purge records. This represents a critical breakdown in the application's access control model, allowing a lateral movement between tenant data containers. The vulnerability is explicitly fixed in version 0.26.0 by ensuring that all database transactions involving maintenance entries are scoped by the requester's authorized group identity."
}