The flaw in HomeBox allows a user with a global owner role to permanently erase the entire inventory of any group they belong to by sending a POST request to /v1/actions/wipe-inventory with an X‑Tenant header pointing to that group. The API incorrectly authorizes the wipe action based solely on the caller’s global ownership flag, ignoring the caller’s role within the selected group. The result is irreversible loss of inventory data that can only be restored from external backups, representing a severe breach of data integrity and availability.

Sysadminsmedia’s HomeBox home‑inventory application is affected. Versions before 0.26.0 are vulnerable; the hardening introduced in 0.26.0 resolves the issue by validating the user’s group membership against the X‑Tenant header and checking the caller’s role within that group.

The vulnerability scores 8.1 on the CVSS scale, indicating high severity. No EPSS score is available, so the precise likelihood of exploitation is uncertain; however, the attack does not require external code execution or elevated privileges beyond a global owner role that a self‑registered user automatically receives. The issue is not listed in CISA KEV, but the potential for permanent data loss makes it a critical risk. An attacker who holds global owner status can misconfigure the X‑Tenant header to target any group they are a member of, triggering an irreversible wipe of that group’s inventory.