What’s Vulnerable › Vulnerabilities

CVE-2026-48974: HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-21 · updated 2026-09-29
• Weakness: CWE-841

Description

HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring an owner role, an invitation token, target-user consent, or target-user notification. Any authenticated user can force another account into the caller's group, disclose the target user's email address and name through the resulting member list, and create the membership prerequisite used by a separate cross-group inventory-wipe vulnerability. This issue is fixed in version 0.26.0.

Affected products

• sysadminsmedia homebox: before 0.26.0

References

• https://github.com/sysadminsmedia/homebox/commit/ed3216a80998dfd81d4418700696244144883160
• https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0
• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-ffcw-whqh-hgqf

Get alerted when CVE-2026-48974 or the next vulnerability affects your stack