CVE-2026-48974 sysadminsmedia CVE debrief

Who should care

Defenders responsible for HomeBox deployments, security teams, and vulnerability management teams should verify exposure and apply the fix to prevent unauthorized group membership and potential data disclosure. Operators and administrators of HomeBox should also be aware of the vulnerability and take necessary actions to protect their systems.

Why it matters

CVE-2026-48974 allows unauthorized group membership and potential data disclosure in HomeBox deployments prior to version 0.26.0, requiring verification and fix application.

• Potential unauthorized group membership
• Potential data disclosure through email address and name
• Creation of membership prerequisite for separate cross-group inventory-wipe vulnerability
• Verification of exposure and application of fix prioritized

Technical summary

The vulnerability allows any authenticated user to force another account into the caller's group, disclose the target user's email address and name, and create a membership prerequisite for a separate cross-group inventory-wipe vulnerability. This issue is fixed in version 0.26.0 of HomeBox. The vulnerability is caused by insufficient authorization checks in the HandleGroupMemberAdd and GroupService.AddMember functions. Affected deployments should prioritize verification and application of the fix to prevent unauthorized group membership and potential data disclosure.

Defensive priority

Defenders should prioritize verifying exposure and applying the fix, as the vulnerability allows for unauthorized group membership and potential data disclosure.

Recommended defensive actions

• Verify exposure by checking if the current version of HomeBox is prior to 0.26.0
• Apply the fix by upgrading to version 0.26.0 or later
• Monitor for potential unauthorized group membership and data disclosure
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. The fix is available in version 0.26.0 of HomeBox. Defenders should verify exposure by checking the current version of HomeBox and apply the fix to prevent unauthorized group membership and potential data disclosure. Evidence is limited to public CVE and NVD details. Further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.