CVE-2026-40196

{
  "id": "CVE-2026-40196",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-17T21:16:33.863",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultGroup ID remained permanently assigned to a user after being invited to a group, even after their access to that group was revoked. While the web interface correctly enforced the access revocation and prevented the user from viewing or modifying the group's contents, the API did not. Because the original group ID persisted as the user's defaultGroup, and this value was not properly validated when the X-Tenant header was omitted, the user could still perform full CRUD operations on the group's collections through the API, bypassing the intended access controls. This issue has been fixed in version 0.25.0."
    },
    {
      "lang": "es",
      "value": "HomeBox es un sistema de inventario y organización del hogar. Las versiones anteriores a la 0.25.0 contienen una vulnerabilidad donde el ID de defaultGroup permanecía asignado permanentemente a un usuario después de ser invitado a un grupo, incluso después de que su acceso a ese grupo fuera revocado. Aunque la interfaz web aplicaba correctamente la revocación del acceso e impedía al usuario ver o modificar el contenido del grupo, la API no lo hacía. Debido a que el ID del grupo original persistía como el defaultGroup del usuario, y este valor no se validaba correctamente cuando se omitía el encabezado X-Tenant, el usuario aún podía realizar operaciones CRUD completas en las colecciones del grupo a través de la API, eludiendo los controles de acceso previstos. Este problema ha sido solucionado en la versión 0.25.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "sysadminsmedia",
          "product": "homebox",
          "versions": [
            {
              "version": "< 0.25.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-20T13:22:13.405894Z",
          "id": "CVE-2026-40196",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-708"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sysadminsmedia:homebox:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "0.25.0",
              "matchCriteriaId": "1F70CA15-79A0-4B2E-9B21-AD1B08FD5140"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/sysadminsmedia/homebox/releases/tag/v0.25.0",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-6pvm-v73p-p6m9",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}