CVE-2026-40196 - Vulnerability Analysis

Overview

HomeBox < 0.25.0 contains a broken access control vulnerability caused by improper validation of defaultGroup ID in the API when X-Tenant header is omitted, letting users perform unauthorized CRUD operations on groups, exploit requires user to be invited to a group.

Severity & Score

Impact

Users can bypass access controls to perform full CRUD operations on groups they should no longer access, risking unauthorized data modification.

Mitigation

Update to version 0.25.0 or later.

References

• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-6pvm-v73p-p6m9
• https://github.com/sysadminsmedia/homebox/releases/tag/v0.25.0

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner