An authorization bypass vulnerability in HomeBox allows authenticated users to modify or delete data belonging to other tenants, posing a significant risk to data integrity.

This is an authorization bypass vulnerability (CWE-639) occurring in the backend maintenance entry repository, where the application fails to verify if the authenticated user has ownership rights over a requested maintenance record UUID.

The ability for a low-privileged user to modify or destroy records belonging to other tenants can result in severe data loss and unauthorized data manipulation within the home inventory system. With a CVSS score of 8.1, this vulnerability is classified as High severity, as it directly impacts the integrity and availability of organizational data for all users of the platform.

Immediate Action: Upgrade the HomeBox installation to version 0.26.0 or later to apply the necessary authorization checks.

Proactive Monitoring: Review application access logs for suspicious patterns of sequential UUID access or unusual update and delete requests originating from low-privileged accounts.

Compensating Controls: Implement strict access control lists at the network or application gateway level if immediate patching is not possible, and ensure that internal audits are conducted to detect unauthorized modifications.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to data integrity within the HomeBox environment. Administrators are urged to prioritize the update to version 0.26.0 immediately to prevent potential data loss and unauthorized cross-tenant interference.