CVE-2026-40196

HomeBox (home inventory system) versions prior to 0.25.0 are affected by an access control flaw where a user’s defaultGroup ID remains assigned after being invited to a group, and revocation via the web interface does not apply to the API. The root cause is that the original group ID persists as ...

CVE-2026-27981

HomeBox vulnerability CVE-2026-27981 allows an attacker to bypass authentication rate limiting by spoofing client IPs via X-Real-IP and manipulating X-Forwarded-For, since the authRateLimiter reads these headers and r.RemoteAddr unconditionally, with RealIP middleware overwriting the remote addre...

CVE-2026-27600

CVE-2026-27600 : In HomeBox, prior to version 0.24.0-rc.1, the notifier allows authenticated users to specify arbitrary URLs for HTTP POST requests without validating host/IP/port. This can yield a behavioral side-channel that enables internal service enumeration, as the UI behavior varies with t...

CVE-2026-26272

CVE-2026-26272 – HomeBox is affected by a stored XSS in the item attachment upload feature. An authenticated user can upload HTML or SVG files containing JavaScript due to improper validation of file types; attachments are served via direct links and the script runs in the app’s origin when opene...