CVE-2026-40196

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40196", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-09T20:59:17.620Z", "datePublished": "2026-04-17T21:01:18.530Z", "dateUpdated": "2026-04-20T13:36:06.776Z"}, "containers": {"cna": {"title": "HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation", "problemTypes": [{"descriptions": [{"cweId": "CWE-708", "lang": "en", "description": "CWE-708: Incorrect Ownership Assignment", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-6pvm-v73p-p6m9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-6pvm-v73p-p6m9"}, {"name": "https://github.com/sysadminsmedia/homebox/releases/tag/v0.25.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/sysadminsmedia/homebox/releases/tag/v0.25.0"}], "affected": [{"vendor": "sysadminsmedia", "product": "homebox", "versions": [{"version": "< 0.25.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T21:01:18.530Z"}, "descriptions": [{"lang": "en", "value": "HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultGroup ID remained permanently assigned to a user after being invited to a group, even after their access to that group was revoked. While the web interface correctly enforced the access revocation and prevented the user from viewing or modifying the group's contents, the API did not. Because the original group ID persisted as the user's defaultGroup, and this value was not properly validated when the X-Tenant header was omitted, the user could still perform full CRUD operations on the group's collections through the API, bypassing the intended access controls. This issue has been fixed in version 0.25.0."}], "source": {"advisory": "GHSA-6pvm-v73p-p6m9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40196", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-20T13:22:13.405894Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T13:36:06.776Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40196", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-20T13:22:13.405894Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T13:32:45.561Z"}}], "cna": {"title": "HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation", "source": {"advisory": "GHSA-6pvm-v73p-p6m9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "sysadminsmedia", "product": "homebox", "versions": [{"status": "affected", "version": "< 0.25.0"}]}], "references": [{"url": "https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-6pvm-v73p-p6m9", "name": "https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-6pvm-v73p-p6m9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/sysadminsmedia/homebox/releases/tag/v0.25.0", "name": "https://github.com/sysadminsmedia/homebox/releases/tag/v0.25.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultGroup ID remained permanently assigned to a user after being invited to a group, even after their access to that group was revoked. While the web interface correctly enforced the access revocation and prevented the user from viewing or modifying the group's contents, the API did not. Because the original group ID persisted as the user's defaultGroup, and this value was not properly validated when the X-Tenant header was omitted, the user could still perform full CRUD operations on the group's collections through the API, bypassing the intended access controls. This issue has been fixed in version 0.25.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-708", "description": "CWE-708: Incorrect Ownership Assignment"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T21:01:18.530Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40196", "state": "PUBLISHED", "dateUpdated": "2026-04-20T13:36:06.776Z", "dateReserved": "2026-04-09T20:59:17.620Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-17T21:01:18.530Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "homebox", "vendor": "sysadminsmedia", "versions": [{"status": "affected", "version": "< 0.25.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sysadminsmedia:homebox:*:*:*:*:*:*:*:*", "matchCriteriaId": "1F70CA15-79A0-4B2E-9B21-AD1B08FD5140", "versionEndExcluding": "0.25.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultGroup ID remained permanently assigned to a user after being invited to a group, even after their access to that group was revoked. While the web interface correctly enforced the access revocation and prevented the user from viewing or modifying the group's contents, the API did not. Because the original group ID persisted as the user's defaultGroup, and this value was not properly validated when the X-Tenant header was omitted, the user could still perform full CRUD operations on the group's collections through the API, bypassing the intended access controls. This issue has been fixed in version 0.25.0."}, {"lang": "es", "value": "HomeBox es un sistema de inventario y organizaci\u00f3n del hogar. Las versiones anteriores a la 0.25.0 contienen una vulnerabilidad donde el ID de defaultGroup permanec\u00eda asignado permanentemente a un usuario despu\u00e9s de ser invitado a un grupo, incluso despu\u00e9s de que su acceso a ese grupo fuera revocado. Aunque la interfaz web aplicaba correctamente la revocaci\u00f3n del acceso e imped\u00eda al usuario ver o modificar el contenido del grupo, la API no lo hac\u00eda. Debido a que el ID del grupo original persist\u00eda como el defaultGroup del usuario, y este valor no se validaba correctamente cuando se omit\u00eda el encabezado X-Tenant, el usuario a\u00fan pod\u00eda realizar operaciones CRUD completas en las colecciones del grupo a trav\u00e9s de la API, eludiendo los controles de acceso previstos. Este problema ha sido solucionado en la versi\u00f3n 0.25.0."}], "id": "CVE-2026-40196", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40196", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T13:22:13.405894Z", "version": "2.0.3"}}]}, "published": "2026-04-17T21:16:33.863", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/sysadminsmedia/homebox/releases/tag/v0.25.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-6pvm-v73p-p6m9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-708"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.25.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "homebox", "source": "cna", "vendor": "sysadminsmedia"}, "product": "homebox", "vendor": "sysadminsmedia"}], "analysis": {"en": {"generated_at": "2026-04-18T08:57:16.240935+00:00", "value": {"mitigation_remediation": ["Upgrade HomeBox to version 0.25.0 or later, which removes the persistent defaultGroup assignment.", "Ensure all API requests include a valid X\u2011Tenant header that matches the requester\u2019s current group membership, and enforce server\u2011side validation of this header before processing CRUD operations.", "Audit API activity logs for unexpected CRUD actions on collections belonging to groups from which a user has been revoked, and immediately revoke or block any unauthorized access found."], "summary": {"action": "Patch", "impact": "Unauthorized API access"}, "threat_synthesis": {"affected_systems": "The HomeBox inventory system from sysadminsmedia, in any release before 0.25.0. No specific sub\u2011version list is provided beyond the fact that the problem exists in all older releases.", "description_and_impact": "HomeBox versions prior to 0.25.0 suffered from improper access control. When a user was invited to a group, the group\u2019s ID was permanently stored as the user\u2019s defaultGroup. Even after their access to that group was revoked, the API did not enforce the revocation because the X-Tenant header was optional and the stored defaultGroup ID was not validated. Consequently, a denied user could issue CRUD requests on the group\u2019s collections through the API, bypassing the web interface\u2019s enforcement. This flaw exposes the group\u2019s data to unauthorized actors and can lead to unintended disclosure, alteration, and deletion of assets. The weakness is categorized as CWE-708, improper access control.", "risk_and_exploitability": "The CVSS score of 8.1 marks the issue as high severity. EPSS is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, indicating that no public exploits are documented. However, because API access is remote and the flaw stems from missing validation, a malicious actor who has been revoked from a group can exploit the API by omitting the X\u2011Tenant header or by providing the persisted defaultGroup ID, thereby performing full CRUD operations on the group\u2019s data."}}}}, "created": "2026-04-17T23:00:12.395264+00:00", "updated": "2026-04-18T09:00:05.901703+00:00", "vendors": ["sysadminsmedia", "sysadminsmedia$PRODUCT$homebox"]}