Vulnerability in Sysadminsmedia Homebox
CVE-2026-85287
HomeBox is a home inventory and organization system. Prior to 0.27.0, POST /api/v1/users/register and the users.email uniqueness constraint treat email addresses as case-sensitive while HomeBox uses a case-insensitive login lookup. An unauthenticated attacker who knows a victim's email can register a differently cased variant, creating duplicate rows that cause login to return 401 for both variants and deny the victim access, while also bypassing the one-account-per-email policy. This issue is fixed in version 0.27.0.
Published .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Sysadminsmedia Homebox — versions < 0.27.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-85287?
- CVE-2026-85287 is a medium-severity vulnerability in Sysadminsmedia Homebox, classified under Improper Handling of Case Sensitivity. CVSS score: 6.5/10. Published 2026-11-05.
- How severe is CVE-2026-85287?
- Medium severity. CVSS v3 base score is 6.5 out of 10.