An IDOR flaw in the maintenance entry update and delete APIs allows an authenticated user with low privileges to modify or permanently delete another tenant’s maintenance record. The weakness is a classic missing authorization check (CWE-639). By supplying a valid UUID belonging to a different tenant, the attacker can overwrite the record or remove it entirely, compromising integrity and availability of the victim’s maintenance history.

sysadminsmedia HomeBox versions prior to 0.26.0 are affected. The vulnerability resides in the backend/internal/data/repo/repo_maintenance_entry.go file of the HomeBox application, and all installations running any release older than 0.26.0 are susceptible.

The CVSS score of 8.1 indicates high severity. Although EPSS data is not available and it is not listed in CISA’s KEV catalog, the prerequisite of an authenticated user with knowledge or enumeration of another tenant’s UUID makes the attack vector feasible in environments with weak tenant isolation. The impact includes data tampering and loss, and the vulnerability can be exploited by anyone who can access the API with an account on the same server.