A critical authorization bypass vulnerability in HomeBox allows authenticated users to permanently delete inventory data belonging to other groups, posing a severe risk to data integrity.

The application improperly manages privileges by relying on global ownership flags rather than group-specific roles when processing the POST /v1/actions/wipe-inventory endpoint. By supplying a different X-Tenant header, any authenticated user can trigger a destructive wipe operation on unauthorized group inventories.

The exploitation of this flaw leads to the permanent, irreversible loss of inventory records, which can cause significant operational disruption and data loss for organizations relying on the platform. With a CVSS score of 8.1, the vulnerability is classified as High severity because it allows a low-privileged user to perform high-impact destructive actions that compromise the availability and integrity of business-critical information.

Immediate Action: Update the HomeBox installation to version 0.26.0 or later immediately to apply the required authorization checks.

Proactive Monitoring: Review web server and application access logs for repeated or suspicious POST requests to the /v1/actions/wipe-inventory endpoint, particularly those involving multiple X-Tenant header values from a single user account.

Compensating Controls: Implement strict network segmentation or Web Application Firewall (WAF) rules to restrict access to the /v1/actions/ endpoint to trusted IP ranges or authorized administrative roles until the software update can be applied.

Public Exploit Available: Unknown

Given the potential for permanent data loss and the ease with which this vulnerability can be triggered by any authenticated user, immediate remediation is required. Administrators should prioritize upgrading to version 0.26.0 and verify that all current group permissions are correctly configured following the update to ensure the integrity of the inventory management system.