CVE-2026-48975

Executive Summary

CVE-2026-48975 is a broken object-level authorization (IDOR) vulnerability in HomeBox, a self-hosted home inventory and organization system. Prior to version 0.26.0, the MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete methods operate on records by ID without verifying that the target maintenance entry belongs to the authenticated user's active group. An authenticated low-privileged user who knows or enumerates another tenant's maintenance-entry UUID can overwrite or permanently delete that record. With a CVSS 3.1 base score of 8.1, the flaw carries high integrity and availability impact while requiring only low privileges and no user interaction.

Technical Analysis

HomeBox is a multi-tenant home inventory application: users are organized into groups (tenants), and each group owns its own inventory and associated records, including maintenance entries. Authorization in a well-designed multi-tenant system must be enforced at the object level — that is, every read or write operation on a record must confirm that the record's owning group matches the requesting user's active group.

According to the NVD description, the affected code resides in backend/internal/data/repo/repo_maintenance_entry.go. The methods MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete invoke UpdateOneID(id) and DeleteOneID(id) respectively, operating directly on a record selected by its identifier. Critically, these operations do not verify that the maintenance entry referenced by that ID belongs to the authenticated user's active group. This is the textbook definition of CWE-639 (Authorization Bypass Through User-Controlled Key): the attacker supplies a resource identifier that they control, and the server acts upon it without a tenant-ownership check.

The attack surface is the application's HTTP API layer that exposes maintenance-entry update and delete operations. Because the vulnerable methods are invoked after authentication (the actor is "authenticated low-privileged"), the primary missing control is horizontal authorization — a same-privilege-level tenant boundary check — rather than authentication itself. The id parameter (a UUID) is the user-controlled key that enables cross-tenant access. The practical barrier is knowledge or enumeration of a valid UUID belonging to another tenant.

Exploitation Scenarios

The following chain is inferred from the vulnerability class (IDOR / CWE-639) and the facts stated in the NVD description. No public proof-of-concept, Nuclei template, or exploit code is available at the time of writing; the chain below reflects the exploitation logic implied by the flaw, not a published exploit.

1. Reconnaissance / target identification. The attacker authenticates to a HomeBox instance with a legitimate low-privileged account belonging to their own group. They identify the maintenance-entry update and delete endpoints used by the application. The attacker then needs a UUID that references a maintenance entry owned by a different group. This can be obtained through any channel that leaks identifiers — shared links, logs, exports, error messages, or predictable/sequential identifier patterns if present. The description explicitly notes the attacker may "know or enumerate another tenant's maintenance-entry UUID," so brute-force or systematic enumeration of identifier space is also in scope where identifiers are guessable.

2. Triggering the flaw. With a candidate UUID from another tenant in hand, the attacker submits an update or delete request targeting that identifier. Because MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete call UpdateOneID(id) / DeleteOneID(id) without a group-ownership check, the request succeeds even though the record belongs to a foreign group.

3. Payload / execution method. At the vulnerability-class level, the "payload" is simply a foreign tenant's record identifier supplied in the request. For Update, the request body carries attacker-chosen field values that overwrite the victim's maintenance entry. For Delete, the request carries no body beyond the target identifier, and the record is removed. No memory-corruption or code-execution primitive is involved; the impact is direct unauthorized data manipulation.

4. Post-exploitation impact. Successful exploitation yields cross-tenant data integrity and availability impact: the attacker can corrupt or falsify another group's maintenance history (integrity) or permanently destroy it (availability). Because deletion is permanent per the description, there is no trivial recovery path for the victim. The attacker gains no confidentiality impact per the CVSS vector (C:N) — the flaw as scored concerns overwrite/delete, not disclosure — though any identifier leakage used to enable the attack may itself constitute an information exposure outside the scope of this CVE.

Impact Assessment

The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base score 8.1 (High).

• Attack Vector (N – Network): the flaw is exploitable over the network via the application's API, requiring no local access.
• Attack Complexity (L – Low): no special conditions or race windows are required; the attacker only needs a valid foreign identifier.
• Privileges Required (L – Low): a basic authenticated account suffices; no administrative role is needed.
• User Interaction (N – None): no victim action is required.
• Scope (U – Unchanged): impact remains within the vulnerable application's security authority.
• Confidentiality (N – None): the scored impact does not include data disclosure.
• Integrity (H – High): the attacker can overwrite arbitrary foreign maintenance entries, directly corrupting trusted data.
• Availability (H – High): permanent deletion of foreign records destroys data availability for the owning tenant.

Business impact is concentrated on multi-tenant or shared-instance deployments of HomeBox, where a single low-privileged user can tamper with or destroy other tenants' maintenance records. Integrity and availability of inventory maintenance history are the primary assets at risk. Blast radius is bounded by which foreign UUIDs the attacker can obtain or enumerate — the wider the identifier leakage or the more guessable the identifiers, the larger the potential impact. EPSS has not yet been assigned by FIRST.org (do not assume a value), and the CVE is not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: HomeBox Cross-Tenant Maintenance Entry Modification or Deletion (CVE-2026-48975)
id: 8f3c1a2e-5b7d-4c9a-9e21-cve202648975
status: experimental
description: Detects update or delete operations against maintenance entries that may belong to a foreign group, consistent with IDOR abuse in HomeBox prior to 0.26.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-48975
author: valtersit.com
date: 2026-01-01
logsource:
  category: application
  product: homebox
detection:
  selection_method:
    http.request.method:
      - PUT
      - PATCH
      - DELETE
  selection_path:
    url.path|contains: 'maintenance'
  selection_tenant:
    - 'group_id': null
    - 'active_group_mismatch': true
  condition: selection_method and selection_path
falsepositives:
  - Legitimate users managing their own maintenance entries
level: high
tags:
  - attack.t1078
  - attack.t1485

YARA Rule

rule CVE_2026_48975_HomeBox_IDOR
{
    meta:
        description = "Detects references to vulnerable HomeBox maintenance entry repository methods lacking tenant checks (CVE-2026-48975)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-48975"

    strings:
        $p1 = "repo_maintenance_entry.go"
        $p2 = "MaintenanceEntryRepository"
        $m1 = "UpdateOneID"
        $m2 = "DeleteOneID"

    condition:
        $p1 and $p2 and (any of ($m*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-48975 HomeBox Cross-Tenant Maintenance Entry Update/Delete Attempt"; flow:established,to_server; http.method; content:"DELETE"; http.uri; content:"maintenance"; nocase; classtype:attempted-user; reference:cve,2026-48975; sid:202648975; rev:1;)

Elastic Detection

sequence by user.id with maxspan=30s
  [http where http.request.method in ("PUT","PATCH","DELETE")
   and url.path like~ "*maintenance*"]
  [http where http.response.status_code in (200, 204)
   and url.path like~ "*maintenance*"]

Splunk SPL Query

index=web sourcetype=homebox OR sourcetype=access_combined
| search (method=PUT OR method=PATCH OR method=DELETE) uri_path="*maintenance*"
| stats count values(uri_path) as paths by src_ip, user
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="homebox,cve-2026-48975,">
  <rule id="100975" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.method">DELETE|PUT|PATCH</field>
    <field name="url.path">maintenance</field>
    <description>CVE-2026-48975: Possible cross-tenant HomeBox maintenance entry modification/deletion</description>
    <mitre>
      <id>T1078</id>
      <id>T1485</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version metadata is available from tracked sources; HomeBox 0.26.0 is identified in the NVD description as the fixed version.

1. Immediate mitigations

• Apply object-level authorization at the API boundary: ensure every maintenance-entry update and delete request validates that the target record's owning group matches the authenticated user's active group before invoking the repository method. Implement this at a layer that cannot be bypassed by supplying a foreign id.
• Constrain network exposure of HomeBox instances; do not expose the API directly to untrusted networks.
• Audit logs for anomalous Update/Delete requests against maintenance records from low-privileged accounts and correlate source IPs and user identities.

2. Patch / upgrade steps

• Track the HomeBox project for release 0.26.0, which the NVD description states fixes the issue. Validate the fix in a staging environment before production rollout. Where the project publishes signed releases, verify artifact integrity prior to deployment.

3. Long-term hardening

• Adopt a consistent object-level authorization pattern across all repositories so that identifier-based operations always carry a tenant check.
• Reduce identifier predictability and leakage: avoid exposing UUIDs in logs, exports, or error messages to unprivileged callers.
• Implement integration tests that assert cross-tenant operations fail (negative authorization tests).
• Enable centralized logging and alerting on cross-tenant access attempts.

References

• NVD — CVE-2026-48975: https://nvd.nist.gov/vuln/detail/CVE-2026-48975
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• HomeBox project repository (vendor source for release 0.26.0 notes): https://github.com/hay-kot/homebox
• CISA Known Exploited Vulnerabilities catalog (verified: CVE-2026-48975 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST.org EPSS (no score assigned at time of writing): https://www.first.org/epss/

No public proof-of-concept, exploit code, Nuclei template, or threat-actor campaign has been associated with CVE-2026-48975 at the time of this report.