CVE-2026-48974

Name of the Vulnerable Software and Affected Versions HomeBox versions prior to 0.26.0

Description An authenticated user can add any other account to a group without requiring an owner role, an invitation token, target-user consent, or notification. This occurs because the endpoint '/v1/groups/members' invokes the functions HandleGroupMemberAdd() and GroupService.AddMember() using a caller-supplied userID without proper authorization checks. This flaw allows an attacker to force users into a group, disclose the target user's name and email address via the member list, and establish a membership prerequisite for other attacks.

Recommendations Update to version 0.26.0.