A vulnerability in the HomeBox API allows authenticated users to perform unauthorized actions on collections after group access is revoked, posing a risk to data integrity.

This is an incorrect ownership assignment vulnerability (CWE-708) where the API fails to re-validate the defaultGroup ID when the X-Tenant header is omitted. An authenticated user can maintain unauthorized access to group collections via the API even after their group membership has been formally revoked.

The vulnerability permits unauthorized users to read, modify, or delete sensitive inventory data stored within HomeBox collections. Given the CVSS score of 8.1, this flaw represents a high risk to data confidentiality and integrity, potentially leading to significant operational disruption if inventory records are manipulated or exfiltrated by unauthorized parties.

Immediate Action: Upgrade to HomeBox version 0.25.0 or later to ensure the API correctly validates user access rights and handles the defaultGroup ID assignment.

Proactive Monitoring: Monitor API access logs for unusual patterns, specifically looking for CRUD operations initiated by users who have recently had their group access revoked.

Compensating Controls: Implement strict network-level access controls to limit API exposure to trusted internal networks only, reducing the likelihood of exploitation by unauthorized remote actors.

Public Exploit Available: No

The vulnerability poses a significant risk to the integrity of inventory data managed within the HomeBox platform. Organizations currently running versions earlier than 0.25.0 should prioritize the update to the patched version immediately to prevent potential unauthorized access to sensitive collections via the API.