# CVE-2026-48974: HomeBox missing authorization in group membership endpoint

Source: https://junglewise.ai/threats/cve-2026-48974-homebox-is-a-home-inventory-and-organization-system-prior-to-0-26  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-48974 · Severity: medium · CVSS 5.4 · Published 2026-09-21

HomeBox is a home inventory and organization system that allows users to manage and organize household items. The flaw enables any authenticated user to forcibly add other users to their group without permission, exposing the target user's email and name, and creating a foothold for further attacks on shared inventories. An attacker needs only basic login access to the application to exploit this vulnerability.

Technologies: [HomeBox](https://junglewise.ai/threats/technologies/homebox-homebox). Vendors: [HomeBox](https://junglewise.ai/threats/vendors/homebox).

## Quick answers

**Is CVE-2026-48974 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48974 being exploited in the wild.

**How severe is CVE-2026-48974?** Medium severity, with a CVSS score of 5.4, published 21 September 2026.

**Which products and versions are affected?** HomeBox prior to 0.26.0.

**Is there a fix for CVE-2026-48974?** A patch was published on 2026-06-13: Version 0.26.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48974 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-48974?** Check whether you run HomeBox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The POST /v1/groups/members endpoint in HomeBox prior to 0.26.0 fails to validate caller authorization when adding group members—specifically, it does not require the caller to be a group owner, does not request an invitation token, and does not verify target-user consent or notify the target. An authenticated attacker can abuse this to add arbitrary users to groups they control, disclosing PII and creating prerequisites for related inventory-wipe attacks. The flaw is resolved in version 0.26.0.

## Affected products

- HomeBox HomeBox prior to 0.26.0

## Timeline

- 2026-09-21: disclosed
- 2026-06-13: patched: Version 0.26.0 released

## References

- [https://github.com/sysadminsmedia/homebox/commit/ed3216a80998dfd81d4418700696244144883160](https://github.com/sysadminsmedia/homebox/commit/ed3216a80998dfd81d4418700696244144883160)
- [https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0](https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0)

## Related threats

- [HomeBox stored XSS in custom fields via javascript: URI scheme](https://junglewise.ai/threats/cve-2026-75599-homebox-is-a-home-inventory-and-organization-system-prior-to-0-27)
- [HomeBox notifier SSRF in DNS64/NAT64 environments](https://junglewise.ai/threats/cve-2026-55473-homebox-is-a-home-inventory-and-organization-system-prior-to-0-26)