TI-2026-25111 Aliases CVE-2026-32602

Homarr has a Race Condition in Invite Token Registration (TOCTOU)

MEDIUM 53CWE-367Published 2026-04-06 · Updated 2026-04-06

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Homarr is an open-source dashboard. Prior to 1.57.0, the user registration endpoint (/api/trpc/user.register) is vulnerable to a race condition that allows an attacker to create multiple user accounts from a single-use invite token. The registration flow performs three sequential database operations without a transaction: CHECK, CREATE, and DELETE. Because these operations are not atomic, concurrent requests can all pass the validation step (1) before any of them reaches the deletion step (3). This allows multiple accounts to be registered using a single invite token that was intended to be single-use. This vulnerability is fixed in 1.57.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00112 1st percentileScored 2026-11-07

Fix Fixed homarr (homarr-labs): 1.57.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
homarr-labs	homarr	before 1.57.0	1.57.0	Patch available	CNA

homarr Vendorhomarr-labs Affected before 1.57.0 Fixed in 1.57.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:homarr:homarr::::::::	before 1.57.0	Vulnerable	homarr-labs

cpe:2.3:a:homarr:homarr:*:*:*:*:*:*:*:* Versions before 1.57.0 Vulnerable ·homarr-labs

Remediation

Fix · CNA homarr (homarr-labs) Fixed in 1.57.0

Timeline

2026-10-02 Threatist record created from CVE-2026-32602

References

Advisory 1

https://github.com/homarr-labs/homarr/security/advisories/GHSA-vfw3-53q9-2hp8

TI-2025-34138 eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for… KEVCVSS 3.1HIGH 7.5
TI-2026-22150 Homarr: Unauthenticated Information Disclosure (Integration Metadata Leak) CVSS 3.1HIGH 7.5
TI-2026-25906 DOM-Based XSS in Homarr /auth/login Redirect CVSS 3.1HIGH 8.8
TI-2026-22151 Homarr: Unauthenticated SSRF in rssFeed.ts CVSS 3.1MEDIUM 5.3
TI-2025-41252 Homarr: missing input sanitization and possible privilege escalation through ldap search query injection CVSS 3.1CRITICAL 9.0
TI-2025-40097 Homarr is Vulnerable to Stored Cross-Site Scripting (XSS) and Possible Privilege Escalation via Malicious SVG Upload CVSS 3.1HIGH 8.1

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences