CVE-2026-48974

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48974
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48974.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48974
Aliases
  • GHSA-ffcw-whqh-hgqf
Published
2026-09-21T17:42:59Z
Modified
2026-09-25T03:30:23Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler
Details

HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring an owner role, an invitation token, target-user consent, or target-user notification. Any authenticated user can force another account into the caller's group, disclose the target user's email address and name through the resulting member list, and create the membership prerequisite used by a separate cross-group inventory-wipe vulnerability. This issue is fixed in version 0.26.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-841",
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48974.json"
}
References

Affected packages

Git / github.com/sysadminsmedia/homebox

Affected ranges

Type
GIT
Repo
https://github.com/sysadminsmedia/homebox
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ed3216a80998dfd81d4418700696244144883160
Fixed
c0bcd3b4682fce0fb512cb191ea754d725e416ee
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.26.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.0
v0.11.0
v0.11.1
v0.12.0
v0.12.1
v0.13.0
v0.14.0
v0.14.1
v0.14.2
v0.15.0
v0.15.1
v0.15.2
v0.16.0
v0.17.0
v0.17.1
v0.17.2
v0.18.0
v0.19.0
v0.2.0
v0.20.1
v0.20.2
v0.21.0
v0.22.0-rc.1
v0.22.1
v0.22.2
v0.22.3
v0.23.0
v0.23.0-rc.1
v0.23.1
v0.24.0
v0.24.0-rc.1
v0.24.1
v0.24.2
v0.25.0
v0.25.0-rc.1
v0.26.0-rc.1
v0.3.0
v0.3.1
v0.4.0
v0.5.0
v0.5.1
v0.6.0
v0.7.0
v0.8.0
v0.8.1
v0.8.2
v0.9.0
v0.9.1
v0.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48974.json"