The vulnerability in sysadminsmedia HomeBox before 0.26.0 involves improper enforcement of behavioral workflow in the group membership addition process. Specifically, the POST /v1/groups/members endpoint calls HandleGroupMemberAdd and GroupService.AddMember with a user-supplied userID but does not require the caller to have an owner role, an invitation token, or the target user's consent or notification. This allows any authenticated user to forcibly add another user to their group, exposing the target user's email and name via the member list. Additionally, this unauthorized membership can be leveraged as a prerequisite for a separate cross-group inventory-wipe vulnerability. The issue is resolved in version 0.26.0.

An attacker with any authenticated account can add arbitrary users to their group without authorization, leading to disclosure of personal information (email and name) of the target users. This unauthorized group membership can also facilitate further attacks, such as a cross-group inventory wipe. The confidentiality and integrity of user group membership and associated data are impacted. There is no indication of availability impact.

Upgrade to HomeBox version 0.26.0 or later, where this vulnerability is fixed. Prior versions do not enforce necessary authorization checks for group membership additions. No other mitigation or workaround is indicated.