---
id: CVE-2026-85287
title: >-
  HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and
  Login Denial of Service
summary: >-
  HomeBox is a home inventory and organization system. Prior to 0.27.0, POST
  /api/v1/users/register and the users.email uniqueness constraint treat email
  addresses as case-sensitive while HomeBox uses a case-insensitive login
  lookup. An un…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-178
  - CWE-1024
vendor: sysadminsmedia
product: homebox
affected:
  - homebox < 0.27.0
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T16:03:13.686Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-85287'
references:
  - url: >-
      https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-xqg9-6xxv-3452
    label: >-
      https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-xqg9-6xxv-3452
  - url: >-
      https://github.com/sysadminsmedia/homebox/commit/fbf8c8505b47c3d46aa6c17f7c657906b5b1b83a
    label: >-
      https://github.com/sysadminsmedia/homebox/commit/fbf8c8505b47c3d46aa6c17f7c657906b5b1b83a
  - url: 'https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.0'
    label: 'https://github.com/sysadminsmedia/homebox/releases/tag/v0.27.0'
tags:
  - cve.org
ingestedAt: '2026-11-05T22:38:31.322Z'
---

## Overview

HomeBox is a home inventory and organization system. Prior to 0.27.0, POST /api/v1/users/register and the users.email uniqueness constraint treat email addresses as case-sensitive while HomeBox uses a case-insensitive login lookup. An unauthenticated attacker who knows a victim's email can register a differently cased variant, creating duplicate rows that cause login to return 401 for both variants and deny the victim access, while also bypassing the one-account-per-email policy. This issue is fixed in version 0.27.0.

## Affected

- `homebox < 0.27.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.