Summary
HomeBox contains an authorization flaw in the inventory-wipe endpoint that can let a group member delete another group's complete inventory. The risk arises when the active group is selected through a tenant header but authorization is evaluated using a global owner flag rather than the caller's role in that group.
Affected context
The issue occurs in HomeBox deployments where users can belong to multiple groups and the active group is selected through the X-Tenant request header. The inventory-wipe operation may rely on a global user ownership value instead of resolving authorization against the selected group's membership and role, allowing a user with access to one group to target another group.
Exploit preconditions
- Attack surface: The authenticated
POST /v1/actions/wipe-inventoryAPI endpoint - Required access: An authenticated account that can participate in more than one group or otherwise select a different tenant context
- Trigger point: Processing the inventory-wipe action with a chosen
X-Tenantvalue - Why exploitation is possible: Authorization uses a global owner attribute rather than the caller's effective role in the active group, so group context and privilege can become mismatched
Why this happens
The underlying bug is an authorization-context confusion issue. The handler checks ctx.User.IsOwner, a global property associated with the user, instead of evaluating the user's role and permissions within the group selected for the request.
This maps primarily to CWE-639: Authorization Bypass Through User-Controlled Key, because a user-controlled tenant selector influences the resource context without a corresponding resource-scoped authorization decision. It also relates to CWE-269: Improper Privilege Management, because a broadly scoped ownership privilege is incorrectly applied to a different group.
Potential impact
- An attacker may permanently delete another group's complete inventory
- Users could lose records, organization data, and associated metadata
- Recovery may depend on external backups and could be incomplete
- The issue could undermine trust between tenants or groups in the same application
- Repeated abuse could cause broad data availability and integrity problems
General mitigation guidance
Mitigation generally focuses on making authorization decisions resource-scoped and independent of user-controlled context identifiers.
Common defensive patterns include:
- Resolve the active group on the server and verify the caller's membership before every sensitive operation
- Check the caller's role within the selected group rather than relying on global ownership flags
- Treat tenant or group headers as selectors, not as authorization evidence
- Apply explicit, least-privilege policies to destructive actions
- Add confirmation, soft-delete, retention, or recovery controls for irreversible operations where practical
- Use deny-by-default behavior when group context, membership, or role resolution is ambiguous
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis and code review checks for global privilege fields used in tenant-scoped handlers
- Tests that compare authorization outcomes across multiple groups for the same user
- Policy checks requiring every destructive endpoint to validate resource ownership or membership
- Instrumentation and audit logs for tenant-selection headers combined with destructive actions
- Automated security testing that attempts cross-group access with valid authenticated accounts
Neutral automated code-review or authorization-analysis tools may help identify mismatches between request-selected resources and permission checks.
