Compliance Impact

The vulnerability allows an attacker to create multiple user accounts from a single-use invite token due to a race condition in the registration process. This can lead to unauthorized access and abuse at scale by enabling multiple rogue accounts.

While the CVE description and resources do not explicitly mention compliance with standards such as GDPR or HIPAA, the unauthorized creation of multiple user accounts could potentially impact compliance by undermining access control and user data integrity requirements common in these regulations.

Specifically, unauthorized account creation may increase the risk of data breaches or misuse of personal data, which are critical concerns under GDPR and HIPAA. Therefore, this vulnerability could negatively affect compliance by weakening controls designed to protect user data and restrict access.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-32602 is a race condition vulnerability in the Homarr open-source dashboard's user registration endpoint (/api/trpc/user.register) prior to version 1.57.0.

The vulnerability arises because the registration process performs three sequential database operations—checking the invite token, creating a user, and deleting the invite token—without wrapping them in a single atomic transaction.

This allows multiple concurrent registration requests to pass the validation step before the invite token is deleted, enabling an attacker to create multiple user accounts from a single-use invite token that was intended to be used only once.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access by allowing an attacker to create multiple fully functional user accounts using a single invite token.

• Bypass of the single-use restriction on invite tokens.
• Creation of multiple rogue user accounts that can persist even if some are detected and removed.
• Potential abuse at scale, as one invite token can be reused multiple times to create many accounts.

The overall impact is moderate with low confidentiality and integrity impact, no availability impact, and requires low privileges but high attack complexity.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for multiple user accounts created using the same single-use invite token, which should normally only allow one registration.

One practical approach is to analyze the application logs or database records for concurrent or repeated registrations with the same invite token.

Since the exploit involves sending multiple concurrent requests to the vulnerable endpoint (/api/trpc/user.register), network traffic analysis tools could be used to detect bursts of simultaneous registration attempts.

Suggested commands or methods include:

• Query the user database to find multiple accounts created with the same invite token.
• Use log analysis tools (e.g., grep, awk) to search for repeated usage of the same invite token in registration logs.
• Monitor network traffic for multiple simultaneous POST requests to /api/trpc/user.register endpoint.
• Example command to find repeated invite tokens in logs: `grep '/api/trpc/user.register' /path/to/logfile | awk '{print $invite_token_field}' | sort | uniq -c | sort -nr`

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the Homarr application to version 1.57.0 or later, where this race condition vulnerability is fixed.

If upgrading immediately is not possible, consider implementing temporary controls such as:

• Rate limiting or throttling concurrent registration requests to reduce the chance of race conditions.
• Manually monitoring and invalidating invite tokens after a single use.
• Reviewing and applying patches or code changes that wrap the CHECK, CREATE, and DELETE operations inside a single database transaction to ensure atomicity.

The root fix involves ensuring the registration flow's database operations are atomic, preventing multiple accounts from being created with a single invite token.

Useful 0 Not Useful 0