Homarr CVE-2026-32602

The vulnerability exploits a classic race condition (CWE-367) in Homarr's user registration flow at the /api/trpc/user.register endpoint. The application validates invite tokens and creates user accounts through three separate, non-atomic database operations: first checking token validity, then creating the user account, and finally deleting the spent token. Because these operations execute sequentially without transaction isolation, an attacker can submit multiple concurrent registration requests that all pass the validation step before any request reaches the deletion step. This allows the same invite token to satisfy validation checks for multiple accounts simultaneously. The vulnerability requires network-accessible Homarr instances with invitation-based registration enabled and affects the core authentication and account provisioning subsystem.