CVE-2026-48975

Name of the Vulnerable Software and Affected Versions HomeBox versions prior to 0.26.0

Description An authenticated low-privileged user can overwrite or permanently delete maintenance entry records belonging to other tenants. This occurs because the MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete functions in backend/internal/data/repo/repo maintenance entry.go utilize UpdateOneID(id) and DeleteOneID(id) without verifying if the maintenance entry belongs to the active group of the authenticated user. An attacker can exploit this by knowing or enumerating the UUID of another tenant's maintenance entry.

Recommendations Update to version 0.26.0.