Homarr EUVD-2026-19277

Despite the moderate CVSS score of 4.2, this vulnerability presents a meaningful real-world risk for Homarr deployments that rely on invite tokens as a security boundary. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) correctly reflects that exploitation requires network access, high attack complexity (timing-dependent race conditions are difficult to trigger reliably), and authenticated user status (PR:L), with limited confidentiality and integrity impact. However, the practical impact is significant: an attacker with a single legitimate invite token can circumvent registration restrictions entirely, creating an arbitrary number of accounts to escalate privileges, conduct reconnaissance, or establish persistence. The high attack complexity (AC:H) reflects the race condition's timing sensitivity, but modern concurrent request tools make this relatively achievable. No evidence of active exploitation (KEV status) or public proof-of-concept code is indicated, but the vulnerability has been documented in GitHub security advisories, reducing discovery difficulty for motivated attackers. For environments where registration invites enforce strict access controls, this is a priority remediation target despite the moderate CVSS score.

An attacker with a single legitimate invitation token to a Homarr instance could use a concurrent request tool or custom script to submit multiple registration requests simultaneously, all using the same token. Because the CHECK and CREATE operations complete before the DELETE operation is executed across all concurrent requests, each request passes validation and creates a user account. In practical terms, a user might intercept their invitation link, then use tools like curl or a Python script to submit 10-20 parallel registration requests within milliseconds, resulting in multiple accounts registered under different usernames but all from the single token. This enables the attacker to create numerous accounts for privilege escalation, lateral movement, or evading account-level audit logs on Homarr instances that enforce strict registration policies through single-use invites.