Executive brief
HomeBox is an open-source home inventory management system that lets users organize and track household items. A flaw in version 0.26.0 and earlier allows any registered user to permanently delete another group's complete inventory by exploiting incorrect authorization checks. Since users are marked as global owners by default and can switch between groups, an attacker can target other groups they're a member of, resulting in unrecoverable data loss without external backups.
Technical details
The HandleWipeInventory endpoint in backend/app/api/handlers/v1/v1_ctrl_actions.go authorizes the DELETE via global ctx.User.IsOwner instead of validating the caller's role within the active group selected by the X-Tenant request header. Every self-registered user receives global owner status, enabling privilege escalation within other groups they join. An attacker with network access can POST to /v1/actions/wipe-inventory with an X-Tenant header targeting another group to delete its inventory permanently.
Affected products
- sysadminsmedia HomeBox before 0.26.0
Timeline
- 2026-09-21: disclosed
- 2026-06-13: patched: Fixed in version 0.26.0