CVE-2026-40196Disclosure(sysadminsmedia / homebox)

LOWCVSS 8.1 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch sysadminsmedia homebox systems immediately
Hunt for exploitation attempts and persistence artifacts

Recommended action window: High priority (within 72h)

NVD description

HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultGroup ID remained permanently assigned to a user after being invited to a group, even after their access to that group was revoked. While the web interface correctly enforced the access revocation and prevented the user from viewing or modifying the group's contents, the API did not. Because the original group ID persisted as the user's defaultGroup, and this value was not properly validated when the X-Tenant header was omitted, the user could still perform full CRUD operations on the group's collections through the API, bypassing the intended access controls. This issue has been fixed in version 0.25.0.

sysadminsmedia CVEs Back to dashboard

2.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-6pvm-v73p-p6m9

Other references

https://github.com/sysadminsmedia/homebox/releases/tag/v0.25.0

Weakness type (CWE)

CWE-708

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

homebox

Threat summary

Exploit tooling references are present in monitored signal
Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-04-18); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

sysadminsmedia

Products

homebox

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Disclosure

150.0%

Patch

150.0%

Referenced assets1 URL

By indicator

https://www.cve.org/CVERecord?id=CVE-2026-40196

Classification over time

Date	Total	Labels

2026-04-18	1	Disclosure1
2026-04-21	1	Patch1

Full discourse2 posts

CVE@CVEnew173d
Disclosure
CVE-2026-40196 HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultGroup ID remained permanently assigned to a use… https://www.cve.org/CVERecord?id=CVE-2026-40196
Post summary
CVE-2026-40196 reports a defaultGroup ID assignment flaw in HomeBox versions before 0.25.0; no PoC, exploit, patch, or active exploitation is mentioned.
20010241
57.7K followersView on X
Giuseppe Paternicola@giuseppe_1337171d
Patch
🚨 HIGH: CVE-2026-40196 (CVSS 8.1) in HomeBox <0.25.0 Revoked group access bypassed via API—users retain CRUD operations despite web UI restrictions. Patch to v0.25.0 immediately. #CVE #Vulnerability #PatchNow #ThreatIntel #CyberSecurity https://t.co/e2jt0aMBX8
Post summary
CVE-2026-40196 in HomeBox <0.25.0 is a high‑severity issue that lets revoked group members access CRUD functions via the API; patch v0.25.0 is urgently required.
0000043
26 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	sysadminsmedia	homebox	-	-	-

Explore more

Back to dashboard sysadminsmedia CVEs homebox vulnerabilities