CVE-2026-48975

HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repomaintenanceentry.go use UpdateOneIDid and DeleteOneIDid without verifying that the maintenance entry belongs to the...

PT-2026-96185

Name of the Vulnerable Software and Affected Versions HomeBox versions prior to 0.26.0 Description An authenticated low-privileged user can overwrite or permanently delete maintenance entry records belonging to other tenants. This occurs because the MaintenanceEntryRepository.Update and...