CVE-2026-48975

{
  "etk_id": "ETK-2026-1895",
  "cve_id": "CVE-2026-48975",
  "display_id": "CVE-2026-48975",
  "ghsa_id": "GHSA-7mr6-2wxw-27j9",
  "euvd_id": "EUVD-2026-84034",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in Homebox maintenance entry operations",
  "summary": "Homebox versions before 0.26.0 allow authenticated users to update or delete maintenance entries outside their active group. An attacker can alter or remove another tenant's maintenance records if they know or can discover a target entry identifier.",
  "mitigation": "Upgrade the Homebox container image, including docker and ghcr.io/sysadminsmedia/homebox deployments, to version 0.26.0 or later.",
  "vendor": "docker",
  "product": "docker:sysadminsmedia/homebox",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 0.25.0"
      ],
      "ecosystem": "docker",
      "fixed_versions": [
        "0.26.0"
      ],
      "package_name": "sysadminsmedia/homebox",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 0.25.0"
      ],
      "ecosystem": "docker",
      "fixed_versions": [
        "0.26.0"
      ],
      "package_name": "ghcr.io/sysadminsmedia/homebox",
      "purl": null
    }
  ],
  "cwes": [
    639
  ],
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
  "epss_score": 0.0049,
  "epss_percentile": 0.4101,
  "epss_asof": "2026-10-21",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 18.629970866666667,
  "t0_at": "2026-09-21T17:42:14.826000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-17T18:07:45.886996+00:00",
      "days": 26.01772061337963,
      "is_lower_bound": false,
      "measured_at": "2026-09-21T17:42:14.826000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-09-21T17:42:14.826000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-21T17:42:14.826000+00:00",
      "url": "https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-7mr6-2wxw-27j9"
    }
  }
}