https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 14:42:56 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-48975 <p>HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repo_maintenance_entry.go use UpdateOneID(id) and DeleteOneID(id) without verifying that the maintenance entry belongs to the authenticated user&#39;s active group. An authenticated low-privileged user who knows or enumerates another tenant&#39;s maintenance-entry UUID can overwrite that record or permanently delete it. This issue is fixed in version 0.26.0.</p> <p>HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repo_maintenance_entry.go use UpdateOneID(id) and DeleteOneID(id) without verifying that the maintenance entry belongs to the authenticated user&#39;s active group. An authenticated low-privileged user who knows or enumerates another tenant&#39;s maintenance-entry UUID can overwrite that record or permanently delete it. This issue is fixed in version 0.26.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-48975