CVE-2026-85287 · Package
NO FIX YET · SEE WHAT TO DO
HomeBox, a self-hosted home inventory app, treats email addresses as case-sensitive at registration but case-insensitive at login. An unauthenticated attacker who knows a victim's email can register a differently cased copy, which makes login fail for the victim and bypasses the one-account-per-email rule.
first public Oct 17, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any HomeBox instance before 0.27.0 that allows open registration through POST /api/v1/users/register is exposed. Instances with registration closed or managed only by an admin are not reachable this way, and single-user setups with no public access carry little risk.
Not affected if registration-disabled, version-0.27.0-or-later
Who cares homebox, self-hosted
0.27.0 are affected.0.27.0.HomeBox is a home inventory and organization system. Prior to 0.27.0, POST /api/v1/users/register and the users.email uniqueness constraint treat email addresses as case-sensitive while HomeBox uses a case-insensitive login lookup. An unauthenticated attacker who knows a victim's email can register a differently cased variant, creating duplicate rows that cause login to return 401 for both variants and deny the victim access, while also bypassing the one-account-per-email policy. This issue is fixed in version 0.27.0.
This page as .md ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.