Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-40196

HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultGroup ID remained permanently assigned to a user after being invited to a group, even after their access to that group was revoked. While the web interface correctly enforced the access revocation and prevented the user from viewing or modifying the group's contents, the API did not. Because the original group ID persisted as the user's defaultGroup, and this value was not prope
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:28446a9fe9b84b7bdee4bc6598b1ac3e4b6569b3e093ec54188b1ed8b081e7d1
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"homebox","vendor":"sysadminsmedia","versions":[{"status":"affected","version":"< 0.25.0"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:fe090869d09274bac7298e47a5aa7d6fc50b40e26a21acf2136c54416569ac60 · sha256:0b3a16d493780d59… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:fe090869d09274bac7298e47a5aa7d6fc50b40e26a21acf2136c54416569ac60 · sha256:0b3a16d493780d59… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-708","description":"CWE-708: Incorrect Ownership Assignment","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:fe090869d09274bac7298e47a5aa7d6fc50b40e26a21acf2136c54416569ac60 · sha256:0b3a16d493780d59… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions
{"name":"https://github.com/sysadminsmedia/homebox/releases/tag/v0.25.0","tags":["x_refsource_MISC"],"url":"https://github.com/sysadminsmedia/homebox/releases/tag/v0.25.0"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:fe090869d09274bac7298e47a5aa7d6fc50b40e26a21acf2136c54416569ac60 · sha256:0b3a16d493780d59… · /containers/cna/references/1
{"name":"https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-6pvm-v73p-p6m9","tags":["x_refsource_CONFIRM"],"url":"https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-6pvm-v73p-p6m9"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:fe090869d09274bac7298e47a5aa7d6fc50b40e26a21acf2136c54416569ac60 · sha256:0b3a16d493780d59… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer