HomeBox versions prior to 0.25.0 suffered from improper access control. When a user was invited to a group, the group’s ID was permanently stored as the user’s defaultGroup. Even after their access to that group was revoked, the API did not enforce the revocation because the X-Tenant header was optional and the stored defaultGroup ID was not validated. Consequently, a denied user could issue CRUD requests on the group’s collections through the API, bypassing the web interface’s enforcement. This flaw exposes the group’s data to unauthorized actors and can lead to unintended disclosure, alteration, and deletion of assets. The weakness is categorized as CWE-708, improper access control.

The HomeBox inventory system from sysadminsmedia, in any release before 0.25.0. No specific sub‑version list is provided beyond the fact that the problem exists in all older releases.

The CVSS score of 8.1 marks the issue as high severity. EPSS is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, indicating that no public exploits are documented. However, because API access is remote and the flaw stems from missing validation, a malicious actor who has been revoked from a group can exploit the API by omitting the X‑Tenant header or by providing the persisted defaultGroup ID, thereby performing full CRUD operations on the group’s data.