HomeBox versions prior to 0.25.0 are affected by an access control bypass vulnerability in which revoked group access persists through the API due to improper validation of the defaultGroup user attribute. Although the web interface correctly enforces access revocation, the API fails to validate the X-Tenant header, allowing revoked users to maintain full CRUD operations on group collections through their retained defaultGroup identifier. The vulnerability carries a CVSS score of 8.1 (High), requiring low attack complexity and user authentication but offering high confidentiality and integrity impact with no availability impact. The CVE is not currently listed on the Known Exploited Vulnerabilities catalog, demonstrates minimal community attention with low EPSS probability (0.000320000), and shows no evidence of active exploitation or publicly available exploit code. Mitigation is available through upgrading to HomeBox version 0.25.0 or later.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 0.25.0CPE matchmatch criteria | cpe:2.3:a:sysadminsmedia:homebox:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.