Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-48975

homebox · Vulnerability

CVSS 3.1 8.1 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-48975

Published

HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repo_maintenance_entry.go use UpdateOneID(id) and DeleteOneID(id) without verifying that the maintenance entry belongs to the authenticated user's active group. An authenticated low-privileged user who knows or enumerates another tenant's maintenance-entry UUID can overwrite that record or permanently delete it. This issue is fixed in version 0.26.0.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-48975

Published

homebox

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "sysadminsmedia",
                    "product": "homebox",
                    "versions": [
                        {
                            "version": "< 0.26.0",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON