CVE-2026-48826

Executive Summary

CVE-2026-48826 is a broken authorization vulnerability in HomeBox, a self-hosted home inventory and organization system. Prior to version 0.26.0, the HandleWipeInventory handler authorizes the POST /v1/actions/wipe-inventory endpoint by checking the global ctx.User.IsOwner value rather than the caller's role within the active group, while the active group is selected via the X-Tenant request header. Any self-registered user who created a group receives the global owner value, so a user who is also a member of a second group can select that group via X-Tenant and permanently delete its entire inventory. The impact is high integrity and availability loss (CVSS 8.1), and deletion is not recoverable without external backups.

Technical Analysis

The vulnerability is a privilege-check scoping error, classified as CWE-269 (Improper Privilege Management). HomeBox supports multi-tenancy where users can belong to more than one group and select the active group per request through the X-Tenant header. The HandleWipeInventory function in backend/app/api/handlers/v1/v1_ctrl_actions.go gates the destructive POST /v1/actions/wipe-inventory action on the global ctx.User.IsOwner attribute.

The core defect is that ctx.User.IsOwner is a global, account-level flag, not a per-group (per-tenant) authorization value. The application logic grants the global owner value to every self-registered user who creates a group. As a result, the authorization decision does not validate the caller's role inside the group that is actually targeted by the request. The active group is instead determined by the X-Tenant header, which the caller fully controls. Because the role check and the tenancy selector are decoupled — one uses a global flag, the other uses a client-supplied header — the handler authorizes the wipe based on the wrong trust boundary.

An attacker needs only ordinary authenticated access (low privileges, PR:L) and membership in any additional group. No user interaction (UI:N) and no special network position (AV:N) are required. Successful exploitation permanently deletes the target group's complete inventory. The CVSS vector reflects no confidentiality impact (C:N), but high integrity (I:H) and availability (A:H) impact, yielding a base score of 8.1.

Specific details regarding token issuance, session handling, and secondary role-validation logic beyond the described handler are not available from the source data; the analysis above is limited strictly to the behavior described in the advisory.

Exploitation Scenarios

The attack chain below is derived strictly from the NVD description. No public proof-of-concept is available, and the chain is inferred from the vulnerability class and the described handler behavior.

1. Reconnaissance / target identification: The attacker identifies a HomeBox instance (version prior to 0.26.0). The attacker requires a valid low-privileged account. Because self-registration is available and every self-registered user who creates a group is granted the global owner value, the attacker can self-register and create their own group to acquire the global IsOwner state.

2. Triggering the flaw: The attacker must also be a member of a second group (the victim group) — for example, a shared household, team, or organization group where they hold only a normal role. The attacker sends POST /v1/actions/wipe-inventory and sets the X-Tenant header to select the victim group. The handler evaluates authorization against the global ctx.User.IsOwner value (true for the attacker) instead of the attacker's role inside the selected group, so the request is authorized.

3. Execution method: At the vulnerability-class level, this is an access-control bypass driven by a decentralized/incorrect authorization check combined with a client-controlled tenancy selector. The attacker does not need to craft a complex payload — the request itself is a normal, well-formed API call to a destructive action. The privilege boundary is crossed purely through the mismatch between the global role flag and the X-Tenant-selected group.

4. Post-exploitation impact: The wipe-inventory action permanently deletes the targeted group's complete inventory. Per the advisory, this data is not recoverable without external backups. An attacker could use this to destroy records of a shared household or organizational inventory, causing data loss and operational disruption.

No public PoC, exploit code, or Nuclei template is available, and there is no evidence of exploitation in the wild or CISA KEV listing at this time.

Impact Assessment

Successful exploitation results in permanent, irreversible destruction of a targeted group's inventory data. The CVSS 3.1 base score is 8.1 (High), with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. The attack is network-reachable (AV:N), requires no special conditions (AC:L), needs only low privileges (PR:L), and requires no user interaction (UI:N). The scope is unchanged (S:U).

Integrity (I:H) and availability (A:H) are both rated High because the entire inventory record set for the affected group is deleted and cannot be recovered without external backups. Confidentiality is unaffected (C:N). The blast radius is bounded to the groups an attacker is a member of, but because every self-registered group creator holds the global owner value, the set of potential attackers is effectively any authenticated user who belongs to a second group. Business impact includes loss of asset tracking and inventory records, potential compliance and audit consequences for organizations relying on HomeBox for equipment tracking, and recovery costs if backups are unavailable or stale.

Detection Guidance

Sigma Rule

title: HomeBox Unauthorized Inventory Wipe via X-Tenant Bypass
id: 7c2f9d1a-4b3e-4c8a-9f21-0a1b2c3d4e5f
status: experimental
description: Detects POST requests to the HomeBox wipe-inventory action, which may indicate exploitation of CVE-2026-48826 authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-48826
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: homebox
detection:
  selection_method:
    cs-method: 'POST'
  selection_uri:
    cs-uri-stem|endswith: '/v1/actions/wipe-inventory'
  condition: selection_method and selection_uri
fields:
  - c-ip
  - cs-uri-stem
  - cs(User-Agent)
  - X-Tenant
falsepositives:
  - Legitimate owner-initiated inventory wipes
level: high

YARA Rule

rule CVE_2026_48826_HomeBox_WipeInventory_Exploit
{
    meta:
        description = "Detects HTTP requests abusing HomeBox wipe-inventory authorization bypass (CVE-2026-48826)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-48826"
        date = "2026-01-01"
        severity = "high"

    strings:
        $action = "POST /v1/actions/wipe-inventory" ascii nocase
        $tenant = "X-Tenant" ascii nocase
        $endpoint = "/v1/actions/wipe-inventory" ascii nocase

    condition:
        $endpoint and ($action or $tenant)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-48826 HomeBox Unauthorized Inventory Wipe Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/v1/actions/wipe-inventory"; fast_pattern; http.header; content:"X-Tenant"; nocase; classtype:attempted-admin; reference:cve,2026-48826; sid:202648826; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=10s
  [network where http.request.method == "POST" and url.path == "/v1/actions/wipe-inventory"]

Splunk SPL Query

index=web_logs sourcetype=access_combined OR sourcetype=homebox
| search method=POST uri_path="/v1/actions/wipe-inventory"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, X-Tenant
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,homebox,">
  <rule id="100826" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>POST /v1/actions/wipe-inventory</match>
    <description>CVE-2026-48826: HomeBox unauthorized inventory wipe attempt detected</description>
    <mitre>
      <id>T1485</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict membership in sensitive groups. Since exploitation requires the attacker to be a member of the target group, review and minimize multi-group memberships and remove untrusted users from groups they do not need.
   • Disable or restrict self-registration where possible, since every self-registered user who creates a group obtains the global owner value that enables the bypass.
   • Require authentication and gate access to HomeBox behind a reverse proxy with strong access control, limiting the pool of authenticated users.
   • Ensure regular, tested, external backups of inventory data, as wiped data is not recoverable without them.

2. Patch/upgrade steps:

   • Upgrade HomeBox to version 0.26.0 or later, where the issue is fixed. No vendor patch source is confirmed in tracked data; validate version status against the upstream project before and after upgrading.

3. Long-term hardening:

   • Enforce per-group (per-tenant) role checks for all destructive and privileged actions rather than relying on global account-level flags such as IsOwner.
   • Treat client-supplied tenancy selectors (such as the X-Tenant header) as untrusted input and always validate authorization against the role held within the selected group.
   • Apply least-privilege group membership policies and audit role assignments across tenants.
   • Implement monitoring and alerting on the POST /v1/actions/wipe-inventory action (see detection rules) and on anomalous use of the X-Tenant header.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-48826
• HomeBox project (HomeBox is a home inventory and organization system; fixed in 0.26.0) — consult the upstream repository for release notes.
• CWE-269: Improper Privilege Management — https://cwe.mitre.org/data/definitions/269.html
• MITRE ATT&CK T1485: Data Destruction — https://attack.mitre.org/techniques/T1485/
• FIRST EPSS: not yet scored for CVE-2026-48826 at the time of writing.

No public proof-of-concept, exploit code, or Nuclei template is available. There is no evidence of in-the-wild exploitation, and CVE-2026-48826 does not appear in the CISA KEV catalog.