CVE-2026-85287Medium· 6.5▾ SunlitHomeBox is a home inventory and organization system. Prior to 0.27.0, POST /api/v1/users/register and the users.email uniqueness constraint treat email addresses as case-sensitive while HomeBox uses a case-insensitive login lookup. An un…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
HomeBox is a home inventory and organization system. Prior to 0.27.0, POST /api/v1/users/register and the users.email uniqueness constraint treat email addresses as case-sensitive while HomeBox uses a case-insensitive login lookup. An unauthenticated attacker who knows a victim's email can register a differently cased variant, creating duplicate rows that cause login to return 401 for both variants and deny the victim access, while also bypassing the one-account-per-email policy. This issue is fixed in version 0.27.0.
homebox < 0.27.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-85286Low· 3.7HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay
CVE-2026-75599Medium· 5.4HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields
CVE-2026-116680Medium· 6.4Homebox generic notifier SSRF via HTTP redirect after URL validation
CVE-2026-55473Medium· 6.0HomeBox is a home inventory and organization system
CVE-2026-48826High· 8.1HomeBox is a home inventory and organization system
CVE-2026-48976High· 8.1HomeBox is a home inventory and organization system