CVE-2026-48975

8.1 Élevée

Publiée le 21/09/2026 à 20:17 · Modifiée le 23/09/2026 à 20:26 · Analyse NVD reportée · Source : security-advisories@github.com

Description

HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repo_maintenance_entry.go use UpdateOneID(id) and DeleteOneID(id) without verifying that the maintenance entry belongs to the authenticated user's active group. An authenticated low-privileged user who knows or enumerates another tenant's maintenance-entry UUID can overwrite that record or permanently delete it. This issue is fixed in version 0.26.0.

Traduire en français

Produits concernés

sysadminsmedia homebox

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.1 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H`

Faiblesses (CWE)

CWE-639

Références

https://github.com/sysadminsmedia/homebox/commit/ed3216a80998dfd81d4418700696244144883160
https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0
https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-7mr6-2wxw-27j9

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories