CyberRota Analysis
AI-GeneratedThe vulnerability affects HomeBox versions prior to 0.26.0, where the MaintenanceEntryRepository allows authenticated low-privileged users to overwrite or delete maintenance entries belonging to other tenants due to insufficient access controls. This can lead to unauthorized data manipulation, potentially impacting the integrity of the home inventory system. Organizations using HomeBox should prioritize upgrading to version 0.26.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repo_maintenance_entry.go use UpdateOneID(id) and DeleteOneID(id) without verifying that the maintenance entry belongs to the authenticated user's active group. An authenticated low-privileged user who knows or enumerates another tenant's maintenance-entry UUID can overwrite that record or permanently delete it. This issue is fixed in version 0.26.0.