Race Condition Vulnerability in Homarr Dashboard by Homarr Labs

CVE-2026-32602

What is CVE-2026-32602?

The Homarr Dashboard prior to version 1.57.0 is susceptible to a race condition in its user registration endpoint. This vulnerability enables an attacker to exploit the registration process, allowing them to create numerous user accounts using a single-use invite token. The user registration sequence involves three separate database operations—CHECK, CREATE, and DELETE—executed sequentially without a transactional framework. Due to the lack of atomicity, an attacker can send concurrent requests that all successfully pass the validation check before any request can execute the deletion of the invite token. This flaw in the registration logic effectively undermines the intended single-use nature of invite tokens, allowing malicious exploitation. The issue has been addressed in version 1.57.0.

References