CVE-2026-85287
HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
HomeBox is a home inventory and organization system. Prior to 0.27.0, POST /api/v1/users/register and the users.email uniqueness constraint treat email addresses as case-sensitive while HomeBox uses a case-insensitive login lookup. An unauthenticated attacker who knows a victim's email can register a differently cased variant, creating duplicate rows that cause login to return 401 for both variants and deny the victim access, while also bypassing the one-account-per-email policy. This issue is fixed in version 0.27.0.
| CWE | CWE-178 CWE-1024 |
| Vendor | sysadminsmedia |
| Product | homebox |
| Published | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for sysadminsmedia homebox
Be the first to know when new medium vulnerabilities affecting sysadminsmedia homebox are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low
Affected Versions
sysadminsmedia / homebox
< 0.27.0