VulnSocial

CVE-2026-48974Disclosure

LOWCVSS 5.4 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring an owner role, an invitation token, target-user consent, or target-user notification. Any authenticated user can force another account into the caller's group, disclose the target user's email address and name through the resulting member list, and create the membership prerequisite used by a separate cross-group inventory-wipe vulnerability. This issue is fixed in version 0.26.0.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-841CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-21); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-21: 1Mentions · 2026-10-07: 1Patch / Workaround · 2026-10-07: 1Technical Details · 2026-09-21: 1Technical Details · 2026-10-07: 109-2110-07
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-211
Disclosure1
2026-10-071
Patch1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-48974 HomeBox: any authenticated user can force other accounts into their group, leaking names and emails. CVSS 5.4. Patch under review, so restrict access now. https://www.valtersit.com/cve/CVE-2026-48974 #CVE #infosec #cybersecurity #HomeBox #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The text discloses CVE-2026-48974 in HomeBox, detailing technical specifics (CVSS 5.4, account-grouping exploit), identifies a workaround ('restrict access now'), and notes a patch is under review. The emphasis on recommending mitigation actions and pending patch availability classifies this as a Patch-related disclosure.

    0000027
    1.0K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-48974 HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-s… https://www.cve.org/CVERecord?id=CVE-2026-48974

    Post summary

    The text discloses CVE-2026-48974 in HomeBox, detailing the technical flaw (POST endpoint and function invocation) and affected version (prior to 0.26.0), but does not include explicit information about PoCs, exploits, patches, or active exploitation.

    00000808
    58.1K followersView on X

Explore more

Back to dashboard