HomeBox API Flaw Bypasses Access Controls

The National Vulnerability Database has detailed CVE-2026-40196, a high-severity (CVSS 8.1) vulnerability in HomeBox, a home inventory and organization system. Versions prior to 0.25.0 are affected. The flaw stems from an issue where a user’s defaultGroup ID persists after their access to a group is revoked, even though the web interface correctly enforces the revocation.

While the web interface prevents unauthorized viewing or modification, the API does not. An attacker can exploit this by omitting the X-Tenant header when making API calls. This allows full Create, Read, Update, and Delete (CRUD) operations on the group’s collections, completely bypassing intended access controls. This is a critical logic flaw, effectively turning a revoked user into an admin via the API.

This isn’t just a theoretical bypass; it’s a fundamental breakdown of access control at the API layer. The fix, available in version 0.25.0, addresses this by correctly validating the defaultGroup ID and X-Tenant header. Defenders must recognize that UI-level access controls are often insufficient if the underlying APIs are not equally secured.