CVE-2026-32602 Details
Description
Homarr is an open-source dashboard. Prior to 1.57.0, the user registration endpoint (/api/trpc/user.register) is vulnerable to a race condition that allows an attacker to create multiple user accounts from a single-use invite token. The registration flow performs three sequential database operations without a transaction: CHECK, CREATE, and DELETE. Because these operations are not atomic, concurrent requests can all pass the validation step (1) before any of them reaches the deletion step (3). This allows multiple accounts to be registered using a single invite token that was intended to be single-use. This vulnerability is fixed in 1.57.0.
A race condition vulnerability has been identified in the user registration endpoint of Homarr, an open-source dashboard, in versions through 1.56.1. The issue allows an attacker to create multiple user accounts using a single-use invite token. This vulnerability arises because the registration process involves three sequential database operations—check, create, and delete—without a transaction. As a result, concurrent requests can all pass the validation step before any reach the deletion step, enabling the registration of multiple accounts from one invite token.
The vulnerability has been fixed in Homarr version 1.57.0. Users should update to this version.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/homarr-labs/homarr/security/advisories/GHSA-vfw3-53q9-2hp8 | CISA-ADP | Third Party AdvisoryVendor Advisory |
| https://github.com/homarr-labs/homarr/security/advisories/GHSA-vfw3-53q9-2hp8 | [email protected] | Third Party AdvisoryVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| homarr homarr | < 1.57.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 10, 2026 | Initial Analysis | [email protected] |
| Apr 6, 2026 | CVE Modified | CISA-ADP |
| Apr 6, 2026 | New CVE Received | [email protected] |