HomeBox Missing Authorization Vulnerability in Attachment Management API

A vulnerability exists in HomeBox versions through 0.20.0, where the API endpoints for updating and deleting inventory item attachments lack proper authorization checks. This flaw enables authenticated users to manipulate attachments that do not belong to them, potentially leading to unauthorized changes or deletion of important inventory data.

Impact

Exploitation of this vulnerability allows authenticated users to update or delete inventory item attachments belonging to other users, without proper authorization or verification of ownership.

Remediation

Users are advised to upgrade to HomeBox version 0.20.1.