EUVD-2026-84035

HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring an owner role, an invitation token, target-user consent, or target-user notification. Any...

PT-2026-96184

Name of the Vulnerable Software and Affected Versions HomeBox versions prior to 0.26.0 Description An authenticated user can add any other account to a group without requiring an owner role, an invitation token, target-user consent, or notification. This occurs because the endpoint...