CVE-2026-48975 HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox

HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repomaintenanceentry.go use UpdateOneIDid and DeleteOneIDid without verifying that the maintenance entry belongs to the...

CVE-2026-48975

The HomeBox home inventory system is vulnerable to a cross-tenant IDOR (Insecure Direct Object Reference) issue in versions prior to 0.26.0 . The flaw exists in MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete within backend/internal/data/repo/repo_maintenance_entry.go, whe...

EUVD-2026-84034

HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repomaintenanceentry.go use UpdateOneIDid and DeleteOneIDid without verifying that the maintenance entry belongs to the...

CVE-2026-48975 HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox

HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repomaintenanceentry.go use UpdateOneIDid and DeleteOneIDid without verifying that the maintenance entry belongs to the...

CVE-2026-48975: Authorization Bypass Through User-Controlled Key

HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repomaintenanceentry.go use UpdateOneIDid and DeleteOneIDid without verifying that the maintenance entry belongs to the...