HomeBox versions before 0.26.0 contain an improper privilege management vulnerability in the HandleWipeInventory function. The authorization for the POST /v1/actions/wipe-inventory endpoint relies on a global ctx.User.IsOwner flag rather than the caller's role within the active group, which is selected via the X-Tenant request header. Because self-registered users who create a group receive global owner privileges, a user who is a member of multiple groups can exploit this by selecting another group via X-Tenant and permanently deleting its inventory. This vulnerability is addressed in version 0.26.0.

An attacker with membership in multiple groups can permanently delete the entire inventory of a group they do not own by exploiting improper privilege checks. This results in a complete loss of inventory data for the targeted group, with no recovery possible without external backups. The vulnerability does not impact confidentiality but causes high integrity and availability damage.

Upgrade to sysadminsmedia homebox version 0.26.0 or later, where this privilege management vulnerability is fixed. Users should ensure they apply this update to prevent unauthorized inventory deletion. No other mitigations are specified.