CVE-2026-85287: HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service
HomeBox is a home inventory and organization system. Prior to 0.27.0, POST /api/v1/users/register and the users.email uniqueness constraint treat email addresses as case-sensitive while HomeBox uses a case-insensitive login lookup. An unauthenticated attacker who knows a victim's email can register a differently cased variant, creating duplicate rows that cause login to return 401 for both variants and deny the victim access, while also bypassing the one-account-per-email policy. This issue is fixed in version 0.27.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HomeBoxto a version that resolves this vulnerability.Fixed in 0.27.0
Event History
Frequently Asked Questions
Who can exploit this issue and what information do they need?
An unauthenticated attacker can exploit it remotely. They need to know a victim's email address and register a differently capitalized version of that address.
What impact does a successful exploit have?
It creates duplicate accounts for email addresses that differ only by letter case, bypassing the one-account-per-email policy. Because login lookup is case-insensitive, login returns HTTP 401 for both email variants, denying the legitimate user access.
Which HomeBox versions are affected and how is it fixed?
HomeBox versions prior to 0.27.0 are affected. Upgrade to version 0.27.0, which fixes the inconsistency between registration uniqueness handling and login lookup.