https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 04:56:11 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-291947 EUVD-2026-291947 https://cve.radiocsirt.org/vuln/euvd-2026-291947 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40196 <p>HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultGroup ID remained permanently assigned to a user after being invited to a group, even after their access to that group was revoked. While the web interface correctly enforced the access revocation and prevented the user from viewing or modifying the group&#39;s contents, the API did not. Because the original group ID persisted as the user&#39;s defaultGroup, and this value was not properly validated when the X-Tenant header was omitted, the user could still perform full CRUD operations on the group&#39;s collections through the API, bypassing the intended access controls. This issue has been fixed in version 0.25.0.</p> <p>HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultGroup ID remained permanently assigned to a user after being invited to a group, even after their access to that group was revoked. While the web interface correctly enforced the access revocation and prevented the user from viewing or modifying the group&#39;s contents, the API did not. Because the original group ID persisted as the user&#39;s defaultGroup, and this value was not properly validated when the X-Tenant header was omitted, the user could still perform full CRUD operations on the group&#39;s collections through the API, bypassing the intended access controls. This issue has been fixed in version 0.25.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40196