CVE-2026-32602

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32602", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-12T14:54:24.269Z", "datePublished": "2026-04-06T14:42:37.488Z", "dateUpdated": "2026-04-06T15:41:09.966Z"}, "containers": {"cna": {"title": "Homarr has a Race Condition in Invite Token Registration (TOCTOU)", "problemTypes": [{"descriptions": [{"cweId": "CWE-367", "lang": "en", "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/homarr-labs/homarr/security/advisories/GHSA-vfw3-53q9-2hp8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/homarr-labs/homarr/security/advisories/GHSA-vfw3-53q9-2hp8"}], "affected": [{"vendor": "homarr-labs", "product": "homarr", "versions": [{"version": "< 1.57.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T14:42:37.488Z"}, "descriptions": [{"lang": "en", "value": "Homarr is an open-source dashboard. Prior to 1.57.0, the user registration endpoint (/api/trpc/user.register) is vulnerable to a race condition that allows an attacker to create multiple user accounts from a single-use invite token. The registration flow performs three sequential database operations without a transaction: CHECK, CREATE, and DELETE. Because these operations are not atomic, concurrent requests can all pass the validation step (1) before any of them reaches the deletion step (3). This allows multiple accounts to be registered using a single invite token that was intended to be single-use. This vulnerability is fixed in 1.57.0."}], "source": {"advisory": "GHSA-vfw3-53q9-2hp8", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/homarr-labs/homarr/security/advisories/GHSA-vfw3-53q9-2hp8", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-06T15:31:55.262728Z", "id": "CVE-2026-32602", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T15:41:09.966Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32602", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T15:31:55.262728Z"}}}], "references": [{"url": "https://github.com/homarr-labs/homarr/security/advisories/GHSA-vfw3-53q9-2hp8", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T15:32:05.947Z"}}], "cna": {"title": "Homarr has a Race Condition in Invite Token Registration (TOCTOU)", "source": {"advisory": "GHSA-vfw3-53q9-2hp8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "homarr-labs", "product": "homarr", "versions": [{"status": "affected", "version": "< 1.57.0"}]}], "references": [{"url": "https://github.com/homarr-labs/homarr/security/advisories/GHSA-vfw3-53q9-2hp8", "name": "https://github.com/homarr-labs/homarr/security/advisories/GHSA-vfw3-53q9-2hp8", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Homarr is an open-source dashboard. Prior to 1.57.0, the user registration endpoint (/api/trpc/user.register) is vulnerable to a race condition that allows an attacker to create multiple user accounts from a single-use invite token. The registration flow performs three sequential database operations without a transaction: CHECK, CREATE, and DELETE. Because these operations are not atomic, concurrent requests can all pass the validation step (1) before any of them reaches the deletion step (3). This allows multiple accounts to be registered using a single invite token that was intended to be single-use. This vulnerability is fixed in 1.57.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T14:42:37.488Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32602", "state": "PUBLISHED", "dateUpdated": "2026-04-06T15:41:09.966Z", "dateReserved": "2026-03-12T14:54:24.269Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-06T14:42:37.488Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "homarr", "vendor": "homarr-labs", "versions": [{"status": "affected", "version": "< 1.57.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:homarr:homarr:*:*:*:*:*:*:*:*", "matchCriteriaId": "734B6AEF-40FE-4B67-A3B1-66BCB31D30C9", "versionEndExcluding": "1.57.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Homarr is an open-source dashboard. Prior to 1.57.0, the user registration endpoint (/api/trpc/user.register) is vulnerable to a race condition that allows an attacker to create multiple user accounts from a single-use invite token. The registration flow performs three sequential database operations without a transaction: CHECK, CREATE, and DELETE. Because these operations are not atomic, concurrent requests can all pass the validation step (1) before any of them reaches the deletion step (3). This allows multiple accounts to be registered using a single invite token that was intended to be single-use. This vulnerability is fixed in 1.57.0."}], "id": "CVE-2026-32602", "lastModified": "2026-06-17T10:36:04.807", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32602", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-06T15:31:55.262728Z", "version": "2.0.3"}}]}, "published": "2026-04-06T15:17:10.000", "references": [{"source": "security-advisories@github.com", "tags": ["Third Party Advisory", "Vendor Advisory"], "url": "https://github.com/homarr-labs/homarr/security/advisories/GHSA-vfw3-53q9-2hp8"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Third Party Advisory", "Vendor Advisory"], "url": "https://github.com/homarr-labs/homarr/security/advisories/GHSA-vfw3-53q9-2hp8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.57.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "homarr", "source": "cna", "vendor": "homarr-labs"}, "product": "homarr", "vendor": "homarr-labs"}], "analysis": {"en": {"generated_at": "2026-04-10T19:42:12.195940+00:00", "value": {"mitigation_remediation": ["Upgrade Homarr to version 1.57.0 or newer.", "If an upgrade is not immediately possible, disable or restrict the registration endpoint until a fix is applied.", "Audit and monitor account creation logs for anomalous or rapid signup activity.", "Remove any public distribution of invite tokens and enforce stricter token management policies."], "summary": {"action": "Apply Patch", "impact": "Uncontrolled account creation from a single-use invite token"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Homarr dashboard from homarr-labs. Any deployment running a version earlier than 1.57.0 is susceptible. Homarr is an open-source web\u2011based interface for managing services; the registration endpoint in those affected versions can be abused through the race condition.", "description_and_impact": "The race condition allows an attacker to create multiple user accounts using a single-use invite token by exploiting the lack of atomicity between the check, create, and delete database operations. This flaw can lead to an inflated user base, potential misuse of privileges associated with the token, and an elevated risk of unauthorized access or denial of service from an increased number of accounts.", "risk_and_exploitability": "The CVSS score of 4.2 indicates moderate severity, and the EPSS score of less than 1% suggests low likelihood of widespread exploitation. This issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation would require an attacker to obtain a valid invite token and submit multiple registration requests simultaneously or in rapid succession to bypass the single\u2011use check."}}}}, "created": "2026-04-06T20:14:24.899258+00:00", "updated": "2026-04-13T14:27:47.163887+00:00", "vendors": ["homarr-labs", "homarr-labs$PRODUCT$homarr"]}