Executive brief
HomeBox is a home inventory management system. Prior to version 0.26.0, an authenticated user could modify or delete maintenance records belonging to other users in the same instance by guessing or enumerating their unique identifiers, without permission checks. An attacker with a low-privilege account can corrupt or destroy another user's maintenance data.
Technical details
The MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete methods in the backend lack group membership verification, using only the entry ID without confirming the authenticated user belongs to the owning group. An authenticated attacker can invoke these operations over the network with a known or brute-forced maintenance entry UUID to overwrite or delete arbitrary records. This is fixed in version 0.26.0.
Affected products
- sysadminsmedia HomeBox prior to 0.26.0
Timeline
- 2026-09-21: disclosed
- 2026-06-13: patched: Fixed in version 0.26.0