The vulnerability resides in the add‑member endpoint of HomeBox, which accepts a caller‑supplied user ID without verifying that the caller holds an owner role, an invitation token, or that the target account has consented. As a result, any authenticated user can add any other user to their group, effectively forcing a user into a group without their permission. This flaw also exposes the target account’s email address and name through the members list, enabling potential identity-based attacks, and provides a foothold for related cross‑group inventory–wipe exploits. The weakness is a classic instance of missing authorization (CWE‑862) and unauthorized access to a protected resource (CWE‑841).

The issue affects installations of sysadminsmedia’s HomeBox that are prior to version 0.26.0. All users running HomeBox before the 0.26.0 release are susceptible to the forced membership behavior described above.

The CVSS score of 5.4 indicates moderate severity, but the vulnerability is readily exploitable by any authenticated user with at least a standard account. EPSS data is not available and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no widespread or coordinated exploitation to date. Nonetheless, because the attacker need only be authenticated, the risk of unauthorized group membership and subsequent data disclosure remains significant, especially in environments where group membership confers access to inventory or other sensitive data.