Access Control Flaw in HomeBox Affects User Data Integrity
CVE-2026-48975
8.1HIGH
What is CVE-2026-48975?
An access control vulnerability exists in HomeBox, a home inventory and organization system, that allows low-privileged authenticated users to manipulate maintenance entries belonging to other tenants. Prior to version 0.26.0, the application's MaintenanceEntryRepository methods did not sufficiently verify if the requested maintenance entry corresponded to the authenticated user’s active group. This oversight enables users to overwrite or delete maintenance entries they should not have access to. The issue has been addressed in version 0.26.0.
Affected Version(s)
homebox < 0.26.0