Platform
nodejs
Component
homebox
Fixed in
0.25.1
CVE-2026-40196 is a high-severity vulnerability affecting HomeBox versions prior to 0.25.0. This flaw allows an attacker to bypass access controls via the API, potentially leading to unauthorized modification or deletion of home inventory data. The vulnerability stems from a persistent defaultGroup ID that isn't properly validated when the X-Tenant header is omitted. Users are advised to upgrade to version 0.25.0 to address this issue.
The primary impact of CVE-2026-40196 is the potential for unauthorized access and modification of home inventory data within HomeBox. An attacker who can exploit this vulnerability can perform full CRUD (Create, Read, Update, Delete) operations on the affected user's data, even after their access to the group has been revoked through the web interface. This could involve stealing sensitive information about household contents, altering records, or even deleting entire inventories. The lack of proper validation of the X-Tenant header significantly widens the attack surface, allowing attackers to potentially target multiple users if the defaultGroup ID assignment isn't handled correctly. This vulnerability highlights the importance of consistent access control enforcement across all interfaces, including APIs.
CVE-2026-40196 was publicly disclosed on 2026-04-17. There is currently no indication of active exploitation or a public proof-of-concept (POC). The vulnerability has not been added to the CISA KEV catalog. The CVSS score of 8.1 (HIGH) indicates a significant potential for exploitation if left unaddressed.
Exploit Status
EPSS
0.03% (9% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-40196 is to upgrade HomeBox to version 0.25.0 or later, which includes the necessary fix. If an immediate upgrade is not feasible, consider implementing a temporary workaround by strictly enforcing the X-Tenant header for all API requests. This can be achieved through API gateway configuration or custom middleware that rejects requests lacking the header. Additionally, review and audit all API access logs for suspicious activity, particularly focusing on requests that omit the X-Tenant header. After upgrading, confirm the fix by attempting to access group data via the API without the X-Tenant header and verifying that access is denied.
Update to version 0.25.0 or later to mitigate the vulnerability. This update corrects the lack of validation of the X-Tenant header in the API, preventing users from accessing groups they no longer have access to.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-40196 is a high-severity vulnerability in HomeBox versions before 0.25.0 that allows attackers to bypass access controls via the API, potentially leading to unauthorized data modification.
You are affected if you are using HomeBox versions 0.0.0 through 0.24.9. Upgrade to 0.25.0 to mitigate the risk.
Upgrade HomeBox to version 0.25.0 or later. As a temporary workaround, strictly enforce the X-Tenant header for all API requests.
There is currently no indication of active exploitation or a public proof-of-concept.
Refer to the HomeBox project's official communication channels and security advisories for the latest information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.