Executive brief
HomeBox is a home inventory and organization system that allows users to manage and organize household items. The flaw enables any authenticated user to forcibly add other users to their group without permission, exposing the target user's email and name, and creating a foothold for further attacks on shared inventories. An attacker needs only basic login access to the application to exploit this vulnerability.
Technical details
The POST /v1/groups/members endpoint in HomeBox prior to 0.26.0 fails to validate caller authorization when adding group members—specifically, it does not require the caller to be a group owner, does not request an invitation token, and does not verify target-user consent or notify the target. An authenticated attacker can abuse this to add arbitrary users to groups they control, disclosing PII and creating prerequisites for related inventory-wipe attacks. The flaw is resolved in version 0.26.0.
Affected products
- HomeBox HomeBox prior to 0.26.0
Timeline
- 2026-09-21: disclosed
- 2026-06-13: patched: Version 0.26.0 released