CVE-2026-48826

Name of the Vulnerable Software and Affected Versions HomeBox versions prior to 0.26.0

Description An authorization flaw exists in the HandleWipeInventory() function within the backend/app/api/handlers/v1/v1 ctrl actions.go file. The system authorizes the 'POST /v1/actions/wipe-inventory' endpoint using a global ctx.User.IsOwner value rather than verifying the caller's role within the active group specified by the X-Tenant request header. Since any user who creates their own group is assigned the global owner value, they can use the X-Tenant header to target another group they belong to and permanently delete its entire inventory.

Recommendations Update to version 0.26.0.